Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2531c08a58b5592…

MALICIOUS

PDF

99.9 KB Created: 2021-08-04 02:14:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: a5e7cd712506faedce65f29df0acb8ff SHA-1: bff63bd231376bc440756c17f5a1921cd9469504 SHA-256: c2531c08a58b5592142eb7a77afcf953057a2d2c617a8204e4d0723cc4e50207
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links, many pointing to compromised WordPress upload directories, indicating a link farm designed to distribute malicious content. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan. The presence of multiple distinct hosts and the use of UTM parameters suggest an attempt to obscure the true destination and potentially track user clicks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9896

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e2e9ec28fd1---povimik.pdf In PDF document text
    • https://www.potterycommercials.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1607c75278c4f4---54137926611.pdfIn PDF document text
    • http://www.naturapreserved.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c188d7b024---11614061443.pdfIn PDF document text
    • http://karlsbach.de/userfiles/files/bumumixatotasigevomefuw.pdfIn PDF document text
    • http://xn--80aab8aioy.xn--p1ai/userfiles/file/79249980672.pdfIn PDF document text
    • https://northstarexecutivesearch.com/wp-content/plugins/super-forms/uploads/php/files/620b2fc5463e7d7976a0bd9130e0609b/62890661427.pdfIn PDF document text
    • http://eduomania.com/wp-content/plugins/formcraft/file-upload/server/content/files/160dddbbb1c9ed---17333383669.pdfIn PDF document text
    • http://plastikacz.cz/soubory/files/pirivixixavowikobimosiki.pdfIn PDF document text
    • https://abofahed.com/userfiles/file/57617750834.pdfIn PDF document text
    • http://in-dapt.com/wp-content/plugins/formcraft/file-upload/server/content/files/160918dd266cc6---wofilizozu.pdfIn PDF document text
    • https://phatgiaolongan.com/upload/ckupload/files/38333514691.pdfIn PDF document text
    • http://medob.org/SITE/files/editor/file/muwujizefesekirokaziw.pdfIn PDF document text
    • http://cascinamana.it/userfiles/file/sitasonapakonesumixojibo.pdfIn PDF document text
    • http://cmtoolsrental.com/user_img/files/tavunozajagitikidutelali.pdfIn PDF document text
    • http://www.birapart.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d874722ecd8---ziperidetitadizujekulow.pdfIn PDF document text
    • https://swotin.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607df039bdf01---62831777610.pdfIn PDF document text
    • http://computerdoki.hu/user/file/lasezisukivinep.pdfIn PDF document text
    • http://111-orte.de/testarea/cwsCMSlight/media/files/11941578444.pdfIn PDF document text
    • http://contentworks.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1606cff0f145ad---66844596419.pdfIn PDF document text
    • http://mdbim.pl/ubezpiecz/obrazy/file/63827500228.pdfIn PDF document text
    • https://frennphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609579259c5d8---texiji.pdfIn PDF document text
    • http://symbioticlifetech.org/attfile/fckimg/file///2021050712639_626260780.pdfIn PDF document text
    • http://www.euro-fly.eu/userfiles/files/kesumowimuxamejipugosoxo.pdfIn PDF document text
    • https://ltssinternational.com/res/wysiwyg/file/ralat.pdfIn PDF document text
    • http://www.colegiometa.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/160b17ff02f257---vojozoxadapiwaxabuwa.pdfIn PDF document text
    • http://entryexpress.online/chapter_images/files/86914648680.pdfIn PDF document text
    • http://pronobile.de/catalog/file/mixelusogawimokinunipib.pdfIn PDF document text
    • https://unitedcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160fa0025d1306---7916663064.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=arithmetic+worksheets+for+kindergarten+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010cdf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CDF 11180 bytes
SHA-256: 7d65281e59ffa7b5aa4b3d482db6d9d7989aa8dae02568e549e301cd15691fcd
font_01_sfnt_off000126c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126C0 16224 bytes
SHA-256: da79484a7f94e028a8871d907a282bdc2df095dfef79f7b1f2af1efeeab75da7
font_02_sfnt_off00013c65.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13C65 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off00015477.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15477 16736 bytes
SHA-256: 9378a928ed1750330a3be4f9ada8a0e58e96d07f2297aa733d8e26822edd1b3f

Open this report in the interactive analyzer, or submit your own file for analysis.