Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf0a1df1e5e89bac…

MALICIOUS

PDF

84.8 KB Created: 2021-07-08 13:02:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: c310b81251e5022d49e04c9ca71e10e8 SHA-1: bac469b79cf9a122fabe27bea70082b537427e9f SHA-256: bf0a1df1e5e89bac0eab3cab0ba6b2070871280f0d5f38636b883c34f722f47f
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It functions as a link farm, containing numerous URLs pointing to various domains, some of which appear to be compromised or disposable. The presence of a 'download' button lure further suggests a malicious workflow aimed at tricking users into clicking links that likely lead to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9860

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crysiq.ru/uplcv?utm_term=fundamentals+of+reinforced+concrete+by+besavilla+pdf PDF link annotation
    • http://3sdent.com/upload/files/muvutefukabo.pdfIn PDF document text
    • http://fantasypartyentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a30dc3f0d05---3366399527.pdfIn PDF document text
    • http://unseenadventure.com/userfiles/file/mekaloxafada.pdfIn PDF document text
    • https://ecobox.eng.br/wp-content/plugins/super-forms/uploads/php/files/q2jnblv9plvla63lhesi4n4um5/78350137748.pdfIn PDF document text
    • https://chulintemple.org/CKEdit/upload/files/66885185415.pdfIn PDF document text
    • https://sg-design.top/wp-content/plugins/super-forms/uploads/php/files/41a6eb81be2955b9bed84ef1f4d1b34f/zedufilojur.pdfIn PDF document text
    • https://www.havanasalsa-dance-tours.com/wp-content/plugins/super-forms/uploads/php/files/65d5cd241bbc806406bff879f0e22f10/28716049165.pdfIn PDF document text
    • https://genegurumiraclehealer.com/userfiles/file/mofulelenesufetunabagev.pdfIn PDF document text
    • https://www.chortho.co.uk/wp-content/plugins/super-forms/uploads/php/files/gjeu1qivhqcrgr8ejmv1585j8f/46286145442.pdfIn PDF document text
    • https://www.lenoir-elec.com/wp-content/plugins/super-forms/uploads/php/files/8g87r768q02scipsos1m29430f/87025966319.pdfIn PDF document text
    • https://yarsan.ru/wp-content/plugins/super-forms/uploads/php/files/5554c14fbc5e3750da9c8fe77115e599/wakujuxu.pdfIn PDF document text
    • http://elitaliaweb.it/upload/file/51233654169.pdfIn PDF document text
    • http://inwallendorf.de/userfiles/file/salexoboxa.pdfIn PDF document text
    • http://www.kzhep.in.ua/wp-content/plugins/super-forms/uploads/php/files/mea98cqiiq6gnutr6lp78omum1/rafiluguvumidiroxokajedur.pdfIn PDF document text
    • http://nhasachnguyenvancu.com/Images_upload/files/52510993231.pdfIn PDF document text
    • https://sakitonus.ru/wp-content/plugins/super-forms/uploads/php/files/6a6d15add2f7cc84cb8f7d9ffb94fc7e/35641099843.pdfIn PDF document text
    • http://www.driftime.ee/wp-content/plugins/formcraft/file-upload/server/content/files/1607258cfa656e---13813191530.pdfIn PDF document text
    • http://naturalmis.com/userfiles/file/9163709323.pdfIn PDF document text
    • https://sygimportaciones.com/wp-content/plugins/super-forms/uploads/php/files/ejfmat7ba6urrls8133bh5f1me/xoredaxemozevisezobawu.pdfIn PDF document text
    • https://www.adilaltinsoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160758c63a0bcb---83954628773.pdfIn PDF document text
    • http://alfavit.tv/userfiles/file/pijozul.pdfIn PDF document text
    • http://sad-azov.ru/wp-content/plugins/super-forms/uploads/php/files/76ebdf8a68bcd3465fafe026fa23371c/65473970538.pdfIn PDF document text
    • http://mfplus.ba/wp-content/plugins/formcraft/file-upload/server/content/files/160a98313d87e2---76362062949.pdfIn PDF document text
    • https://efnnma.org/files/file/bovanirobagigebumidituze.pdfIn PDF document text
    • https://pabausa.org/wp-content/plugins/formcraft/file-upload/server/content/files/160b30da537f95---vemenekezawufet.pdfIn PDF document text
    • http://st-ark.it/userfiles/files/zunejibolu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e879.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE879 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0001008b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1008B 16604 bytes
SHA-256: 4a10d7999aef7cb857763299310e0333479aec194b9e896d401d8e3033035e42
font_02_sfnt_off00012b89.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12B89 11176 bytes
SHA-256: cb22ed0142464f5924c5887e973e60610af8a79e2d0c0aa1ac990f76f993012d

Open this report in the interactive analyzer, or submit your own file for analysis.