Malicious PDF — malware analysis report

Static analysis result for SHA-256 c994cc2b8b278918…

MALICIOUS

PDF

82.1 KB Created: 2021-09-01 03:10:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: 81c6fdfa3631075d1463cbbc124ab4a5 SHA-1: 0ec311b7b20158180efd728790fb9bca4cc5d214 SHA-256: c994cc2b8b2789182e0693b48e4736a9985b2531e43bb125d51c948291934564
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It functions as a link farm, containing numerous URLs pointing to compromised CMS uploads and disposable hosting. The primary purpose appears to be directing users to external, potentially malicious content, which is a common tactic for phishing or SEO spam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://esistore.com/userfiles/file/27412805311.pdf In PDF document text
    • https://costumeworld.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cca81669c24---33509805397.pdfIn PDF document text
    • https://dm288.rs/slicice/file/wajureroxegazemuvave.pdfIn PDF document text
    • https://hssipm.com/wp-content/plugins/super-forms/uploads/php/files/a2bf4fdd2aab852da34ce687b9f54b61/41260729407.pdfIn PDF document text
    • http://www.pirac.org/wp-content/plugins/super-forms/uploads/php/files/ff851c45134879c80e16b96a82570502/14576911620.pdfIn PDF document text
    • http://fantasypartyentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c93dff35876---31716951185.pdfIn PDF document text
    • https://iwanbim.com/userfiles/files/kixoguvo.pdfIn PDF document text
    • http://enricobarraco.com/files/vidudadokazusepip.pdfIn PDF document text
    • https://freedomtampons.com/wp-content/plugins/super-forms/uploads/php/files/fa4a7101b80e41dcf5dbdaf1e963cd41/kibipom.pdfIn PDF document text
    • http://bannhuaduong.net/upload/files/nedojexubajofususimab.pdfIn PDF document text
    • http://czdashan.cn/uploadfile/file/2021060812485173499.pdfIn PDF document text
    • http://exactblue.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a997359628b---98989563155.pdfIn PDF document text
    • https://www.dekleinewerf.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1612eb909dae42---72242773270.pdfIn PDF document text
    • http://clinicacomciencia.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609b0b5db44f5---9050302275.pdfIn PDF document text
    • https://betonwerkendejonge.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16096d8a0587ae---81599153382.pdfIn PDF document text
    • https://www.kiteschule-kiel.de/wp-content/plugins/formcraft/file-upload/server/content/files/16091ca554a17b---72238082124.pdfIn PDF document text
    • https://cicadit.ro/UserFiles/file/48051369271.pdfIn PDF document text
    • http://stigstudiotecnico.it/userfiles/files/38140098043.pdfIn PDF document text
    • http://futimisdev.com/userfiles/file/bisumofuvudutefageg.pdfIn PDF document text
    • http://icltindia.in/userfiles/file/94545888673.pdfIn PDF document text
    • https://imagebeaute.fr/userfiles/file/70951443602.pdfIn PDF document text
    • https://sgdivorcelawyers.com/wp-content/plugins/super-forms/uploads/php/files/02e5564483fcfd664b9e851d76f7accb/34544007124.pdfIn PDF document text
    • http://lookupagency.es/wp-content/plugins/formcraft/file-upload/server/content/files/1607563d1147b2---31104406965.pdfIn PDF document text
    • https://mikepromedia.com/wp-content/plugins/super-forms/uploads/php/files/kl7be2mduaebjre4msgslqvfr2/soxudip.pdfIn PDF document text
    • https://www.darrellstuckey.com/wp-content/plugins/formcraft/file-upload/server/content/files/160caab460f6f5---96542278728.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/PmAiG5ZyT-k/uplcv?utm_term=how+many+cups+are+in+32PDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db3a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB3A 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000f34c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF34C 17476 bytes
SHA-256: 02a6fafe7733eb49e22289430b2a084bb3e37cf7911ac34cb4f14e8ae7c0dada
font_02_sfnt_off000120c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x120C3 10976 bytes
SHA-256: f9e5bdc1bf8d2ae270d94293df67f4a1c02e7727a88e08fd2af2a145710b688f

Open this report in the interactive analyzer, or submit your own file for analysis.