Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca03ee7006c145a6…

MALICIOUS

PDF

84.0 KB Created: 2021-07-03 04:11:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-29
MD5: f505920b1cf008f9e0adc8a575106c4e SHA-1: 1982eb4edc93ca6fab8356794ba2328d232be2f0 SHA-256: ca03ee7006c145a6e97b7cbfc97c4dc01e8bbf8bf2ac6bdc358f52aa96c8d6c0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a link farm pointing to numerous compromised WordPress sites, likely intended to host malicious files. Heuristics indicate it's a link farm on disposable hosting and that the PDF itself is a compromised CMS upload. ClamAV detection and ML classification confirm its malicious nature, suggesting it's a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://purpledoorchurch.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071b47957990---52741613286.pdf In PDF document text
    • https://www.webplease.it/wp-content/plugins/super-forms/uploads/php/files/plsblqnqlulvk56a7c48sim959/63402383628.pdfIn PDF document text
    • https://rosewoodcity.org/nbloom/fckuploads/file/kinugipipu.pdfIn PDF document text
    • http://julieesteban.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bbb210280fd---22314111940.pdfIn PDF document text
    • http://strategie-online.net/catalogue_dynamique/file/wapusipaxawufiverowoxe.pdfIn PDF document text
    • https://xn--1--8kcai1ck2bs.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/52d40f379a3d8317c44d5f388a534656/legemifuxusezara.pdfIn PDF document text
    • https://www.movingwithmagna.com/wp-content/plugins/super-forms/uploads/php/files/457746240b690bd9ca75572bc05d0680/868453411.pdfIn PDF document text
    • https://daluxerealty.com/wp-content/plugins/super-forms/uploads/php/files/r9oe6a2p6jqg7g4m2g4mmkr5h6/64726395229.pdfIn PDF document text
    • https://nolimitscenter.be/peausitive/images/FCKeditor/file/13457899755.pdfIn PDF document text
    • http://brmhn.com/userfiles/file/20210515113402_6n7637.pdfIn PDF document text
    • https://la-klamm.org/userfiles/file/batumojefa.pdfIn PDF document text
    • https://www.cfo-search.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b990744d3c8---farozuduxagositixerabujev.pdfIn PDF document text
    • https://elitteaccesorios.com/wp-content/plugins/super-forms/uploads/php/files/1m4a5hccpinu7d7uqu6tl7vapt/nuregukaxosuduma.pdfIn PDF document text
    • https://bokseinstituttet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160b02100bfe01---70287260088.pdfIn PDF document text
    • http://ankamet.com/userfiles/file/suzad.pdfIn PDF document text
    • https://thietbivesinhanhhuy.com/asset/files/4935555269.pdfIn PDF document text
    • https://robinio.de/wp-content/plugins/super-forms/uploads/php/files/cius7f5p4gce9jt7chpuophstl/80964854140.pdfIn PDF document text
    • http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/160abe19375e51---24468137903.pdfIn PDF document text
    • https://travels-ukraine.com/wp-content/plugins/formcraft/file-upload/server/content/files/160abf66d0c16a---2245127661.pdfIn PDF document text
    • https://iamluno.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071c3a02aded---kuxirezefusibu.pdfIn PDF document text
    • https://www.mclarenpress.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c6faca4046---xijaderozazovemazuwulebim.pdfIn PDF document text
    • http://uyaviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083df7bc50cd---67043149318.pdfIn PDF document text
    • http://erkerlaender.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a3a3ccd5102---timisuvotitosutale.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=apps+that+give+you+answers+for+mathPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e32c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE32C 17656 bytes
SHA-256: 783ec9a029f6ec98b17b3de5a1db9da7f69c0174e94a8387dacc1de498e21dc2
font_01_sfnt_off0001109e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1109E 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000128b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x128B5 11108 bytes
SHA-256: 3cc5fab54d7dc1d6e25d221598f632629835076a2a1f1557d40d68fef0932bce

Open this report in the interactive analyzer, or submit your own file for analysis.