Malicious PDF — malware analysis report

Static analysis result for SHA-256 c02950d85d497cc3…

MALICIOUS

PDF

80.9 KB Created: 2021-09-08 11:54:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: 5fd75aca655923b205710367e5bdb8f2 SHA-1: 77b951af24eeb4ae62110a530b9db5cc3fb73c51 SHA-256: c02950d85d497cc3eb8654fd5a86acebb0f4b80dd01864c0bcc011499cb8148d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics and an ML classifier as malicious, with ClamAV identifying it as a phishing trojan. The document contains numerous external URIs and links to compromised CMS upload storage, suggesting it functions as a link farm to distribute malicious content or phish for information. The presence of embedded URLs and the nature of the detected heuristics strongly indicate a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9968

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/uplcv?utm_term=kobelco+excavator+parts+manual PDF link annotation
    • http://yetisirkaucuk.com/firma/files/jalisa.pdfIn PDF document text
    • http://biosystech.com/pdsFck/file/28023792056.pdfIn PDF document text
    • https://www.dyna-tech.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160cb10f23fbd8---nexez.pdfIn PDF document text
    • https://www.lightingsolutionsinc.net/wp-content/plugins/super-forms/uploads/php/files/a6cd6e0203d8385261a3d55393b27a6c/supipewizugawuka.pdfIn PDF document text
    • https://holzhaus-suedtirol.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607e451d3892b---58698534292.pdfIn PDF document text
    • http://mountmedpharmacy.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160a49ba5d0bd2---fupurabiwirakibunenebebov.pdfIn PDF document text
    • https://veglifekc.org/wp-content/plugins/super-forms/uploads/php/files//zugajazawelanufada.pdfIn PDF document text
    • https://g3az.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c921ee94de---14582905420.pdfIn PDF document text
    • http://logo4you.dk/userfiles/file/razirosumapidamidikuwelob.pdfIn PDF document text
    • http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/16076d69b6e0e9---30099347791.pdfIn PDF document text
    • https://abril.pe/wp-content/plugins/super-forms/uploads/php/files/da7niapvk3g1me4707kee5o5ud/xenesuzufip.pdfIn PDF document text
    • https://amirep.com/wp-content/plugins/super-forms/uploads/php/files/6cc234537a3fbe797ebf5d8aa4dce3e5/31128672743.pdfIn PDF document text
    • https://pikewallis.no/wp-content/plugins/formcraft/file-upload/server/content/files/16096770d21828---22222487791.pdfIn PDF document text
    • https://samyenngochoang.com/wp-content/plugins/super-forms/uploads/php/files/qg6bngn4qd2rdgakk7i5r88c87/35751476202.pdfIn PDF document text
    • https://socialacademy.gr/wp-content/plugins/super-forms/uploads/php/files/c0db0d6abe3d59369f484bc15576dbfc/dalip.pdfIn PDF document text
    • http://szermgrt.hu/uploads/ckfinder/userfiles/files/zokogifobekoj.pdfIn PDF document text
    • http://americasbestmanassas.com/uploads/files/xasulisatakufabej.pdfIn PDF document text
    • https://www.hotwaterfactory.com.au/wp-content/plugins/super-forms/uploads/php/files/a68ce9681387f6591ad4f044820a1624/xijefupujonazanawavaj.pdfIn PDF document text
    • http://sloplast.com/userfiles/files/venamezirewekuja.pdfIn PDF document text
    • http://huntland.hu/upload/file/ganorilikel.pdfIn PDF document text
    • https://interesttour.com/wp-content/plugins/super-forms/uploads/php/files/2aebd531f28bb44151db9ac8a1d8207e/figebanojosokibi.pdfIn PDF document text
    • http://worldofpacifiers.com/editor_uploads/system/files/pekunemelepanofewetob.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d768.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD768 17752 bytes
SHA-256: 46b194b7d18affe542ed2ef642e07fec00bfd3cb065008690332439a3ae14f2e
font_01_sfnt_off000105c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105C0 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00011dd7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11DD7 10844 bytes
SHA-256: 16b9c1e67609ab4c90da5652bddf863644457356d6cc43c793270fa93e5cdf6b

Open this report in the interactive analyzer, or submit your own file for analysis.