Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca1a217acefa906b…

MALICIOUS

PDF

82.2 KB Created: 2021-09-06 09:54:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: f8abdc0a3656ccc295906f519e3748f0 SHA-1: 9ee9d49c1a065de574afcb77270f118c1e7e640d SHA-256: ca1a217acefa906bf59ca771ae6f01b571249b7b2171ce20aa49942cf454bbde
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to compromised websites or disposable hosting, indicating a link farm designed to lure users to malicious content. The ClamAV detection and ML classifier strongly suggest a phishing or trojan payload delivery. No scripts were extracted, but the structure itself is indicative of a malicious intent to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://eastmangroupllc.net/ckfinder/userfiles/files/jikomav.pdf In PDF document text
    • http://bestapp4u.com/admin/uploadedfiles/file/56038594514.pdfIn PDF document text
    • http://xaydungphongphu.com/uploads/files/gowip.pdfIn PDF document text
    • https://www.ferienhof-schneider.de/wp-content/plugins/formcraft/file-upload/server/content/files/1612c0202310bf---topuradewegiboxanurupetu.pdfIn PDF document text
    • https://khogiaydantuonghanquoc.com/images/news/file/33384861878.pdfIn PDF document text
    • https://nergizleryapi.com/image/files/41731895244.pdfIn PDF document text
    • http://bruningfoundation.com/clients/9/99/99acc79c432c4c389b364f5b25189af3/File/nenitojatubi.pdfIn PDF document text
    • https://relleno-acidohialuronico.com/wp-content/plugins/super-forms/uploads/php/files/1f0f0904512f5ce2e52ecd4cc2cc0fa1/guzox.pdfIn PDF document text
    • https://www.gico.ge/ckfinder/userfiles/files/lenew.pdfIn PDF document text
    • http://epwuae.com/userfiles/file/79280918442.pdfIn PDF document text
    • http://bitree.net/ckfinder/userfiles/files/lelugofixerugevebufar.pdfIn PDF document text
    • http://www.atrium-tuiles.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bc19f22def0---28793756027.pdfIn PDF document text
    • http://traditionsradio.com/wp-content/plugins/super-forms/uploads/php/files/9mj73gjld5pu2u1vf6abv6cbu3/17360993349.pdfIn PDF document text
    • http://metzpaintings.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608fa00dac87c---31506616367.pdfIn PDF document text
    • https://avenue102.com/uploads/file/porezeperiwufeto.pdfIn PDF document text
    • https://siyata.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/160d2adb2b2200---japalijimaxugulaw.pdfIn PDF document text
    • http://ziepniekkalns.lv/wp-content/plugins/formcraft/file-upload/server/content/files/1609db14166807---16628041239.pdfIn PDF document text
    • https://frontiersneurophotonics.org/wp-content/plugins/formcraft/file-upload/server/content/files/1/160801114c1a1d---fiwurirefituponodo.pdfIn PDF document text
    • https://nailseasupportgroup.com/wp-content/plugins/super-forms/uploads/php/files/a27709ca2a458b76c0fecc0ba8d9690b/74049655360.pdfIn PDF document text
    • https://securitydm.com/slicice/file/vaxezujesoxaji.pdfIn PDF document text
    • http://www.ashtralmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/160de0ab1cdeed---38401885855.pdfIn PDF document text
    • http://yaeram.com/userData/board/file/80329434184.pdfIn PDF document text
    • http://24cvety.ru/upload/files/35243133935.pdfIn PDF document text
    • https://independentmusicleague.com/wp-content/plugins/super-forms/uploads/php/files/1eb24e9a1d13fcc1023cc3f2f55bca29/senenor.pdfIn PDF document text
    • https://mandalaconfeccao.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160ad30bbcbc9d---65387121894.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/BvfzZFkJO3s/uplcv?utm_term=complete+guide+to+asperger%27s+syndrome+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd8b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD8B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000f59d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF59D 16608 bytes
SHA-256: 10c730b0a7dc9d107847431f0f5ee20a97941088d91c37d3c4da1f4e4df1b71c
font_02_sfnt_off000120bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x120BD 11120 bytes
SHA-256: 59e82bea13641cc356b675fc812ed6d38a0bba30e5e5a65da3c5e22ce98a6179

Open this report in the interactive analyzer, or submit your own file for analysis.