Malicious PDF — malware analysis report

Static analysis result for SHA-256 c226ae398fce3d3a…

MALICIOUS

PDF

73.7 KB Created: 2021-06-14 16:00:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 95dacc636ff993ddefb250fd856f740d SHA-1: 06d4672811f2e6f798fe36f2d8cdc904924a1fcf SHA-256: c226ae398fce3d3ad88971ade27f5aa2073a683f7563dbb72e3d65cfaae6b811
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics and an ML classifier as malicious, with ClamAV identifying it as a phishing trojan. The document contains numerous embedded URLs pointing to compromised WordPress sites, suggesting a link farm designed to redirect users to malicious or phishing content. While no scripts were directly extracted, the presence of these compromised links indicates a likely intent to lure users into a malicious ecosystem.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crysiq.ru/uplcv?utm_term=elizabeth+nantel+avocate PDF link annotation
    • https://djhelaly.com/wp-content/plugins/super-forms/uploads/php/files/9ff6387489d6c42ea211d86215adaccd/nagovisowexuwijatuvu.pdfIn PDF document text
    • https://www.sharpeningfactory.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609830cb2e606---61909528165.pdfIn PDF document text
    • http://english-island.pl/wp-content/plugins/super-forms/uploads/php/files/8rnotitnte45n8cpdp83sa7ct0/nejipanetulew.pdfIn PDF document text
    • https://homeaestheticsllc.com/wp-content/plugins/super-forms/uploads/php/files/41324f31a7f2e4162c1d98b064406972/4193956279.pdfIn PDF document text
    • http://oio.cn/uploadfiles/files/38865173663.pdfIn PDF document text
    • https://www.infrascale.com/wp-content/plugins/super-forms/uploads/php/files/531b525e28acc64fabb02a2cde126e58/80777787871.pdfIn PDF document text
    • http://aaexpansionjoint.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a7b2f0ed010---mifogawanevavavom.pdfIn PDF document text
    • https://www.taxikladis.gr/wp-content/plugins/formcraft/file-upload/server/content/files/1609486622ed75---46699277816.pdfIn PDF document text
    • https://www.lowdoc-loans.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607cefbcb0e37---58928326274.pdfIn PDF document text
    • http://www.studiolegalefusimorelli.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082a62c62f4f---94705182821.pdfIn PDF document text
    • https://edoxmarketing.com/wp-content/plugins/super-forms/uploads/php/files/6n3e6f4j8c2qdrk8497pehq1ot/3763580942.pdfIn PDF document text
    • https://robinio.de/wp-content/plugins/super-forms/uploads/php/files/h3t5mn2a33np2tdeqjk4ri8tjq/zaraxuwosegu.pdfIn PDF document text
    • http://audiomaster.se/wp-content/plugins/formcraft/file-upload/server/content/files/160763b49357cc---bovawem.pdfIn PDF document text
    • https://viajespereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607478ec4f652---donipupuvudiguziwus.pdfIn PDF document text
    • https://www.mobytec.com.br/mobytec/wp-content/plugins/formcraft/file-upload/server/content/files/16091c3cbc0f6c---xuxunamoxokawowiki.pdfIn PDF document text
    • https://saftanton.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1609902bcea24c---60404387500.pdfIn PDF document text
    • https://pyhm.ca/wp-content/plugins/super-forms/uploads/php/files/mp34enr8s5maun09qhscnh41jd/kirobopobitoxivuvanaz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e254.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE254 4820 bytes
SHA-256: f9525e95120b9c5d520acdb6b3c0cdc249066d7c36274512a8cd4e0a1e0a822c
font_01_sfnt_off0000f2ca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2CA 12000 bytes
SHA-256: 615ce779eab1c933e022f397d7045a755d440e62ef9fff5d7e69343b8d672283

Open this report in the interactive analyzer, or submit your own file for analysis.