Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb3eacf6284eeff3…

MALICIOUS

PDF

85.1 KB Created: 2021-06-29 15:49:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-13
MD5: 02134f0d6239184d49cace6d2a23bd86 SHA-1: 84d88142ca4c26d68b33566720fc72c4779b6a1a SHA-256: cb3eacf6284eeff3853842caf0fcd3c41bb288616fd52af74cf3dbc5ff4a2115
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link farm pointing to multiple compromised WordPress sites, suggesting an attempt to distribute further malicious content. ClamAV detection and ML classification strongly indicate malicious intent, specifically identified as phishing and a trojan. Although no scripts were explicitly extracted, the PDF structure and URL patterns are consistent with phishing lures and malware distribution campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://parkwestresidences.com/wp-content/plugins/formcraft/file-upload/server/content/files/160914b9769676---jazis.pdf In PDF document text
    • http://aplus.to/userfiles/file/7070008208.pdfIn PDF document text
    • http://loveperfectionschool.com/upload/file/14257309838.pdfIn PDF document text
    • https://apoc.com.au/wp-content/plugins/super-forms/uploads/php/files/023569fb88b7bad2d2f07ce0ef3dd5f8/timetuza.pdfIn PDF document text
    • https://formapolis.it/wp-content/plugins/super-forms/uploads/php/files/45983adeeb5b39bced9cad4439f5e3f3/68610496569.pdfIn PDF document text
    • https://forex-robo.org/wp-content/plugins/super-forms/uploads/php/files/a553e5edb24073524bb74a51b75dd78f/gozuk.pdfIn PDF document text
    • https://rittenhousesmiles.com/wp-content/plugins/super-forms/uploads/php/files/045f8b899ac2895ded38b18dd729c43d/99951946826.pdfIn PDF document text
    • https://123kozijnofferte.nl/wp-content/plugins/super-forms/uploads/php/files/ilk0aj7pmi5jbgmk93q8rid7s5/muragugojemenodoj.pdfIn PDF document text
    • https://wscnaturalhealings.com/wp-content/plugins/super-forms/uploads/php/files/b91e7fe4aeee15ab8608b7b4f1676b52/66820153642.pdfIn PDF document text
    • http://www.zopfitravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16074b2f3bef5d---korawowa.pdfIn PDF document text
    • https://www.verpoort-bouw.be/wp-content/plugins/formcraft/file-upload/server/content/files/1608e391576333---sodijuduvosuxurolixukal.pdfIn PDF document text
    • https://smarttactic.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16076e00ea460c---12530388573.pdfIn PDF document text
    • http://budoprojekt.eu/obrazy/file/88855536986.pdfIn PDF document text
    • https://sharzh-ufa.ru/wp-content/plugins/super-forms/uploads/php/files/85cdfdb22c037aee1b35521c0bf725e7/dejinegokezofede.pdfIn PDF document text
    • http://udmvdpo.ru/images/files/nafobuvijafonugukiz.pdfIn PDF document text
    • http://hgbs.de/userfiles/file/paxonorewipemoxidadukimo.pdfIn PDF document text
    • http://www.irrv.org/uploads/files/46266333709.pdfIn PDF document text
    • http://www.191seo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab9aac63fff---xarazapedutatuvexo.pdfIn PDF document text
    • https://aslimitada.com/userfiles/file/80347810139.pdfIn PDF document text
    • https://earplighting.com/wp-content/plugins/super-forms/uploads/php/files/55b94f473beafe9b9751cb6f8e54496d/90707676771.pdfIn PDF document text
    • http://www.naturapreserved.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c399f7266cb---sumopejaz.pdfIn PDF document text
    • https://cald-lighting.com/wp-content/plugins/super-forms/uploads/php/files/66bd55aee09b83dfdaac1387e7057288/36142513151.pdfIn PDF document text
    • http://ajivikafinance.com/userfiles/file/wefesewusekomegixave.pdfIn PDF document text
    • https://psychotherapie-dr-albrecht.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606efa804a561---fedisejuduzolefove.pdfIn PDF document text
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608840c17214b---duxiv.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=integration+property+of+fourier+transformPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e68e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE68E 17708 bytes
SHA-256: 4930a160804df2fbfa21f118f93dfc6e6c03d13ed47eb39b10df043557c2fe69
font_01_sfnt_off000115a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x115A3 10820 bytes
SHA-256: 9a9e5570ad13467536c8239f0347828b37b57bda8ea4615351c370475bcac278
font_02_sfnt_off00012e9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12E9F 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.