Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5092336a90f3de4…

MALICIOUS

PDF

79.7 KB Created: 2021-07-17 12:20:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: b9b0e3ef8f3de4df986ffafc7e40342b SHA-1: cb2b4ba5dfee78919bf0aa6c2f7eee538f8e267c SHA-256: c5092336a90f3de43d46de96eccd3a125766601c83327ea11a3872869a8b2591
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics as malicious, including a high-confidence ML classifier and ClamAV detection. The presence of a 'password-protected archive lure' heuristic indicates the document likely attempts to trick the user into downloading an archive, which is often used to bypass security scanning. The document also contains a link farm pointing to compromised WordPress upload storage, suggesting a distribution mechanism for malicious payloads. No scripts were extracted, but the overall pattern suggests a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9949

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.syah.org/wp-content/plugins/super-forms/uploads/php/files/d6af86de6bafd3b9788ce57c5f68b9d5/77117645773.pdf In PDF document text
    • http://grafiport.com/userfiles/file/45688859632.pdfIn PDF document text
    • http://perrymanreunion.com/clients/f/f8/f8644f0eb9578147d5589f75b8c3e300/File/vasejupizezo.pdfIn PDF document text
    • https://relaxationplusmn.com/wp-content/plugins/super-forms/uploads/php/files/3f6504e5de74e4fd9175664476088037/fafefokonupuxanatel.pdfIn PDF document text
    • https://bloomeng.com/uploads/duwisulonujazabofelelo.pdfIn PDF document text
    • http://mirrorgallery.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b3fc9be5994---78378451736.pdfIn PDF document text
    • http://lso-msm.fr/userfiles/file/lezegefodaluzip.pdfIn PDF document text
    • http://www.fullertherapy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609b360343d42---6748878698.pdfIn PDF document text
    • http://xn--80ackbssfuieecff0e8c.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/7u06jdr8hufq8baf9k206ltb63/tukikajorokoxusaxibov.pdfIn PDF document text
    • https://www.avenueroadadvertising.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c8c03b7c8c---resibuzajogajewozazotef.pdfIn PDF document text
    • http://ufnk.fr/app/webroot/files/file/41224387132.pdfIn PDF document text
    • http://losmarinoslanzarote.com/marinarubicon/admin/file/dotuwexikaxikig.pdfIn PDF document text
    • http://geluidsadviesnederland.nl/ckfinder/userfiles/files/jijujirubuto.pdfIn PDF document text
    • https://admonks.ru/wp-content/plugins/super-forms/uploads/php/files/6732a9fdb8b53dd6cc3ba78ec01e78e6/30638494635.pdfIn PDF document text
    • https://funkydrop.shop/wp-content/plugins/super-forms/uploads/php/files/ba5ecd5bad2e4ba2fc47ab5edbacc7bf/95844785375.pdfIn PDF document text
    • https://www.frankcapassoandsons.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b612bc66442---9384087064.pdfIn PDF document text
    • http://vibrosystem.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160bd9b00c6ef4---31511752732.pdfIn PDF document text
    • https://nazragame.com/calisma2/files/uploads/76880102157.pdfIn PDF document text
    • http://brooklinehs1964.com/clients/6/6a/6a3559cec3eb17f551da2d864c8c85ab/File/23500136402.pdfIn PDF document text
    • https://hotel-la-licorne.fr/userfiles/file/kinevefukezobapazati.pdfIn PDF document text
    • https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/16079c5d2cb83a---76237254317.pdfIn PDF document text
    • http://www.everhouse.lt/wp-content/plugins/formcraft/file-upload/server/content/files/1609ec6604e3ac---rikakum.pdfIn PDF document text
    • http://ohsongpharm.com/ckfinder/userfiles/files/74879980897.pdfIn PDF document text
    • https://www.nestroots.com/wp-content/plugins/super-forms/uploads/php/files/jadvb365k1t7aioeu7vp77rjk7/nomagagibedasusorupalim.pdfIn PDF document text
    • https://webmodeli.com/wp-content/plugins/formcraft/file-upload/server/content/files/160dcdf0d67895---mekuwaposalaguje.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BvfzZFkJO3s/uplcv?utm_term=a+solution+of+lead+nitrate+is+mixed+with+potassium+iodidePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD0BA 11032 bytes
SHA-256: 51f67aa371196421a1b4df01cb4bb5e1cb594304c5b3035a4d8df60420012cf7
font_01_sfnt_off0000ea43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA43 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00010255.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10255 17552 bytes
SHA-256: 35752ca027a5e8d206b4a586b5436e579846964be08baebff9967f6ae1ad66af

Open this report in the interactive analyzer, or submit your own file for analysis.