Malicious PDF — malware analysis report

Static analysis result for SHA-256 caa6ef124f895095…

MALICIOUS

PDF

86.0 KB Created: 2021-07-03 04:37:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 7b512e5e35491d4aebd98f2a11e0ad9c SHA-1: e7fe9cefb2ca65eb3f62dbeec282269f284898c2 SHA-256: caa6ef124f895095ed3d505c0373c16a65d81fb39231126187deb9a331e0a58b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links, many of which point to websites hosted on compromised WordPress installations, indicating a potential phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly suggest malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9835

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://systemsbiology.at/uploads/assets/file/38754102921.pdf
    • https://www.areatransfers.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075d9a0cbd58---7271961828.pdf
    • https://realimpacto.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16073aafb31724---vuresulep.pdf
    • http://www.ddd-iasi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160b9c186b2ae0---50698779019.pdf
    • https://www.rockandroll.blog.br/wp-content/plugins/super-forms/uploads/php/files/b3uurnvsuikskndao6fg8kutk4/48718481157.pdf
    • http://xn--80aadq3ae7aa5k.xn--p1ai/upload/file/safawagemeluvujiga.pdf
    • http://www.atrium-tuiles.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b8d75cc9b5---rulanesesepakose.pdf
    • http://elmiraclassiccountry.com/wp-content/plugins/super-forms/uploads/php/files/tr66kubrce0lmoc8ioptsi80d6/51234846231.pdf
    • https://www.ideaklinik.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c1d6727b4a---15045390473.pdf
    • https://hightechrustremovers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608f850a3a782---pofeduluzodofunem.pdf
    • https://www.alarisusallc.com/wp-content/plugins/super-forms/uploads/php/files/d1292bcdd545fd783ffa3c606587c04e/59559219993.pdf
    • http://wildpflanzen-planung.de/file/73835048783.pdf
    • http://asustainable.com/global/file/71217421647.pdf
    • http://densayhongngoai.com/uploads/userfiles/file/38333618197.pdf
    • https://ketdoanbus.com/webroot/img/files/lapixilerefedotaguzo.pdf
    • https://travelselection.us/wp-content/plugins/formcraft/file-upload/server/content/files/160703bc963989---sobuxixelujuvefobixewa.pdf
    • https://flylights.pl/wp-content/plugins/super-forms/uploads/php/files/1c2on5qm47975pg5ue9hrjut8l/66091652719.pdf
    • https://callhfelectric.com/wp-content/plugins/formcraft/file-upload/server/content/files/160866615606ee---92697880564.pdf
    • https://nicemexico.net/wp-content/plugins/formcraft/file-upload/server/content/files/160a99bae48c07---guwuliwuwanakavuluxesaw.pdf
    • https://brusroom.com/wp-content/plugins/super-forms/uploads/php/files/7ce5b650c27208bf794c611eb245bd73/69390912980.pdf
    • https://almondzwealth.com/administrator/imagetemp/file/15261550152.pdf
    • https://ecobox.eng.br/wp-content/plugins/super-forms/uploads/php/files/21ms4jjm4ohq9fk1o4ueuspf0d/sigaket.pdf
    • http://kaies.cn/upfiles/file/tonexatikalitafo.pdf
    • http://richmediahouse.com/admin/uploads/file/lisegiwimoxaxuji.pdf
    • https://www.sesc.com.ua/wp-content/plugins/super-forms/uploads/php/files/2302lh7ov9rmi4sgu91ac4t233/12521423715.pdf
    • http://urbanconstructions.org/images/uploadedimages/file/39879655928.pdf
    • https://hafa-verein.de/wp-content/plugins/super-forms/uploads/php/files/05b1584196c434fca68bfa34879e6225/91014460463.pdf
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BkSY9tpko7c/uplcv?utm_term=itchy+rash+on+inner+thigh
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef25.bin
e19b7e6b60ca46a452555153335a783236926bf2aad927c04a77d01ecfb28879		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF25 10528 bytes
font_01_sfnt_off00010728.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10728 16792 bytes
font_02_sfnt_off00011f3a.bin
3c7815524306ef1e856a91c410ff270b5c8612bafebe4e85fb85534c0bba6731		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F3A 16612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.