Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbd81cbb1aff1167…

MALICIOUS

PDF

94.3 KB Created: 2021-07-03 06:51:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 774b8f198befdc1206927378996f2c49 SHA-1: ed3c4f089f0df5f8d38578160a7e5f2039d7e5a0 SHA-256: bbd81cbb1aff1167d6cd8485cd12bc0ff4f429f0ba3796f7628b19b8c5b1b613
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded URLs that point to compromised WordPress sites and disposable domains, indicating a link farm designed to lure users to malicious content. The ClamAV detection and ML classifier strongly suggest a phishing or trojan payload delivery mechanism. No scripts were extracted, but the heuristic firings clearly indicate the malicious intent of the PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9937

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/uplcv?utm_term=php+logical+interview+questions+and+answers+pdf
    • https://californiaoptionsrealestate.com/wp-content/plugins/super-forms/uploads/php/files/d4a3eb2ebcb38c954e9afa3725aa24cd/zotaganasudifabinu.pdf
    • http://www.webtony.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160962aff18fc8---jilagunemudefuzebiful.pdf
    • http://sh8ke.com/wp-content/plugins/formcraft/file-upload/server/content/files/16085a6932a053---75002540173.pdf
    • http://agataklimowska.pl/userfiles/file/37223789501.pdf
    • https://couvreur-hautdoubs.fr/internet_new/images_et_fichiers//file/34223894438.pdf
    • http://admio.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16079fb4555c1c---10705370252.pdf
    • http://files.ibiza-ferien.de/file/82775781647.pdf
    • https://www.escon.it/wp-content/plugins/super-forms/uploads/php/files/77e4409c66155f6c62c3e645307669a0/57980492902.pdf
    • https://www.ideakliniksisli.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ceb55fec510---15911316894.pdf
    • http://nuyewrecruitment.com/wp-content/plugins/super-forms/uploads/php/files/5edbf35e473b22587d5905416477c490/ketawine.pdf
    • https://rhagro.com.mx/wp-content/plugins/super-forms/uploads/php/files/8c15a099819b76c68c9faf56ef525a49/51518916895.pdf
    • https://regalcabs.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606f1afd8bced---62159059358.pdf
    • http://lisahyatthealth.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a6c1e21a67---dekituga.pdf
    • https://actioncoach.com.my/wp-content/plugins/formcraft/file-upload/server/content/files/160b41e3aeba41---jegivofi.pdf
    • http://diversecityuk.com/userfiles/file/jawuvotufunudixunewu.pdf
    • http://www.combatsim.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160bf8a504637e---74471852756.pdf
    • http://www.scmphotography.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160cd9737588fe---fosuge.pdf
    • http://etpatatietpatata.com/userfiles/files/bofesakerunavapazavesup.pdf
    • http://asea-admin.com/_userfiles/file/20210523180157.pdf
    • http://vom-ragnaroek.de/uploads/file/53964091513.pdf
    • http://yaqeen-eg.com/userfiles/file/xisumut.pdf
    • https://petroblend.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d6587302dc---boxitiw.pdf
    • http://www.victorian-manor.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160b22417cad0c---45141468322.pdf
    • http://danburyhighclassof1961.com/clients/b/b4/b42d7d7907ff1a67dd6fd366dd3c6775/File/nimepodobovinali.pdf
    • http://socialbomjesus.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609c93d8a2cf9---bifuwomobux.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b03.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B03 16792 bytes
font_01_sfnt_off0001231a.bin
b2fae9b57b01dba9025b0af95da486c9c9a13a259d36a7a9c3409057de0db222		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1231A 11300 bytes
font_02_sfnt_off00013d28.bin
aa821a3da4a716954fca90f4dcc473d1404a030ac9ab9a5c2a2e3943b4418e6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D28 17636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.