Malicious PDF — malware analysis report

Static analysis result for SHA-256 c454264a0dabf168…

MALICIOUS

PDF

81.9 KB Created: 2021-08-26 07:02:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12
MD5: 5c670d4ca64c6d43de610a5e1c370f25 SHA-1: 9c69ba288930b38d20c5ec3f992feb2b8db8a8d0 SHA-256: c454264a0dabf168e8f7e8cebe0d620cd4dc8acb8e3061da018af405591c529c
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and a machine learning model, indicating a high likelihood of malicious intent. It contains an embedded JavaScript stream and numerous URLs pointing to compromised CMS uploads and disposable hosting, suggesting it functions as a link farm or phishing lure. The presence of JavaScript indicates an attempt to execute code, likely to redirect users to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/uplcv?utm_term=leighton+meester+natural+hair+color PDF link annotation
    • https://estudiowebcolombia.com/ckfinder/userfiles/files/46249535569.pdfIn PDF document text
    • https://jaunimodienos.lt/wp-content/plugins/super-forms/uploads/php/files/nd42teo2nkdn9o5cb6n4h8tlkd/36278561582.pdfIn PDF document text
    • http://sugarfree-gelato.com/upload/file/31657794111.pdfIn PDF document text
    • http://sushiloverca.com/uploads/files/zasisegijesefugu.pdfIn PDF document text
    • http://jmvlpslimited.com/ci/userfiles/files/noxijonirexige.pdfIn PDF document text
    • http://webinaris.training/ckfinder/userfiles/publics/files/67269698341.pdfIn PDF document text
    • http://sieuthihatgiong.vn/webroot/img/files/lokewewujovazijufedofive.pdfIn PDF document text
    • https://oknoplus-omsk.ru/wp-content/plugins/super-forms/uploads/php/files/4f799448f45d1ae49d524777ed3be4d0/pelubobaletutalar.pdfIn PDF document text
    • https://www.accidentinjurylascruces.com/wp-content/plugins/super-forms/uploads/php/files/j8ebcqncpq83c0bq3ufo9rigmu/vegiwemifomolusuxidet.pdfIn PDF document text
    • http://leap-egypt.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e07b655671e---31268774295.pdfIn PDF document text
    • http://orgue-chantepie.info/FCKeditor/upload/file/lujiwonojizunejej.pdfIn PDF document text
    • http://www.sunarmisir.com.tr/wp-content/plugins/super-forms/uploads/php/files/plbvvm5g22kdbngekauihlktb5/goralerexagu.pdfIn PDF document text
    • https://www.ciabrini-immobilier.com/wp-content/plugins/super-forms/uploads/php/files/8sf86f7lfkrqicg4l23n6g3bjn/19759738090.pdfIn PDF document text
    • https://readxyz.org/wp-content/plugins/super-forms/uploads/php/files/3cc6ecdba925d4a2881e3bc5e3c68f8a/tusiken.pdfIn PDF document text
    • http://masonhn.com/d/files/gupemexux.pdfIn PDF document text
    • https://leo.tw/upload/ckeditor/files/46020670719.pdfIn PDF document text
    • http://julieesteban.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bf57ce2f42f---14917360506.pdfIn PDF document text
    • http://doudou.tw/userfiles/files/xudolurizudil.pdfIn PDF document text
    • http://toyotaprius-custom.com/js/upload/files/sudode.pdfIn PDF document text
    • https://ocvirapuato.com.mx/wp-content/plugins/super-forms/uploads/php/files/416cb92e7498392c6e0c1ba56ca743a1/54677840922.pdfIn PDF document text
    • https://benchmarktransitions.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606eb2dcc0137---kagogesodanoju.pdfIn PDF document text
    • https://holzhaus-suedtirol.it/wp-content/plugins/formcraft/file-upload/server/content/files/160802c9749c61---34495473751.pdfIn PDF document text
    • https://popa.com.br/wp-content/plugins/super-forms/uploads/php/files/db87c59e666775d6c0fb61c69e448d65/sexamovaso.pdfIn PDF document text
    • https://sidexsideaudio.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071b3bbce0ca---munotawu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc58.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC58 17376 bytes
SHA-256: 2d9f48fb309d28aedbc8c8a418c9a4ce750b73418dcb18664eb10cb5816c4ab7
font_01_sfnt_off000109bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109BF 10732 bytes
SHA-256: a8e1fbcd2fc578f498974755851167e475bf973b0a106a2b6ef632fa40d34ce3
font_02_sfnt_off0001223b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1223B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.