Malicious PDF — malware analysis report

Static analysis result for SHA-256 c10b5da7f24f8a20…

MALICIOUS

PDF

83.1 KB Created: 2021-08-15 09:32:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: 89bfe759dd39264955dc5e1b7ebed36a SHA-1: a8cc3f6952df7cdb249b9be1f7b4d7b56849a6eb SHA-256: c10b5da7f24f8a20b812f6583d884b84c1253de17080055647a58cf128269524
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious Link

This PDF file was flagged by a machine learning classifier and ClamAV as malicious. It contains numerous external links, many pointing to compromised WordPress upload directories or disposable hosting, indicating a link farm designed to redirect users. The presence of these links suggests an attempt to lure victims to malicious sites for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garglob.ru/uplcv?utm_term=abox+2.1+soundbar+manual PDF link annotation
    • https://brazilairporttransfers.com/ckfinder/userfiles/files/vujezumizopukijijifopa.pdfIn PDF document text
    • http://nofatrans-int.com/userfiles/file/55455607778.pdfIn PDF document text
    • https://precisionautoandac.com/wp-content/plugins/super-forms/uploads/php/files/e94b5992b6e449ed8c31d18e9fdf7eca/puzufekadupomevanoxobe.pdfIn PDF document text
    • http://svenstavik.com/wp-content/plugins/formcraft/file-upload/server/content/files/160967e0b9b8cd---13416951426.pdfIn PDF document text
    • http://audidalys.lt/ckfinder/userfiles/files/30716729696.pdfIn PDF document text
    • https://snoman.mb.ca/ckfinder/userfiles/files/86536916622.pdfIn PDF document text
    • https://miruyuta96.ru/admin/ckfinder/userfiles/files/diguno.pdfIn PDF document text
    • http://tamker.hu/userfiles/file/28009722399.pdfIn PDF document text
    • https://ocvirapuato.com.mx/wp-content/plugins/super-forms/uploads/php/files/debcd6441337803fd9059b009819baf9/75636349405.pdfIn PDF document text
    • http://vhs1962.com/clients/b/b9/b967f936f519796c2a696a6ed1da67f9/File/kigam.pdfIn PDF document text
    • http://klick-tipp.info/ckfinder/userfiles/publics/files/pujizidevusimepom.pdfIn PDF document text
    • https://www.adler-leitishofen.de/wp-content/plugins/formcraft/file-upload/server/content/files/16076b27dcd933---17367167673.pdfIn PDF document text
    • https://www.goldenplanet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160c424a67b8fc---giwaderoxivolagejoxoluvuw.pdfIn PDF document text
    • https://unique.global/wp-content/plugins/super-forms/uploads/php/files/53e40fe32278c2a29db492d21c56567b/76981484010.pdfIn PDF document text
    • https://globalazeri.az/wp-content/plugins/super-forms/uploads/php/files/pq1ignknivasg5bcmaup25lhj0/31933953699.pdfIn PDF document text
    • http://dabien.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/1608f415c567a8---35477511602.pdfIn PDF document text
    • http://king-ber.com/UploadFiles/file/20210812142646291.pdfIn PDF document text
    • https://aguiapromocional.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16090ccd79bcc1---vaximuwoxaluji.pdfIn PDF document text
    • https://grafitpoint.ru/wp-content/plugins/super-forms/uploads/php/files/1158af1029c9ac3e625f84a12debd60d/7630063963.pdfIn PDF document text
    • https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610ac39225143---57958366762.pdfIn PDF document text
    • http://mebelhotel.ru/userfiles/files/57170152487.pdfIn PDF document text
    • https://resulgame.com/calisma2/files/uploads/jidot.pdfIn PDF document text
    • http://edu-soft.ru/site/htmlimages/file/49438966102.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e118.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE118 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000f92f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF92F 10648 bytes
SHA-256: 55032cb8d4d6e6981cea119998ac31d0b06c15b63fb1fdbf73627f8f6b0b6f6f
font_02_sfnt_off000111aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111AA 17260 bytes
SHA-256: 6bb935bf556bab9e03311ec9cb470acf49f70a05ee6c266058b972d532e401f4

Open this report in the interactive analyzer, or submit your own file for analysis.