Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc7b23d73369ccdf…

MALICIOUS

PDF

81.8 KB Created: 2021-09-06 18:25:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05
MD5: 99046fe89be9c99ee56d3f2cc412caf3 SHA-1: 68bffa7b105327fb9e22f7f0e25be0fe5ec9f947 SHA-256: cc7b23d73369ccdf9f9dae1fdb7f56fe01e65e461ac7e63ad7e3b04c65c7e323
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link

The PDF contains a link farm pointing to multiple compromised CMS upload directories, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were directly extracted, the structure and URL targets are indicative of a malicious document designed to lure users to external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.mixedclass.com.au/wp-content/plugins/super-forms/uploads/php/files/6t2rf52pksskjch23vita5qeg6/zobitakabubalexovagerora.pdf In PDF document text
    • https://ijfbacknumber.com/editor_up/gofatesowerogi.pdfIn PDF document text
    • https://tkpmission.org/wp-content/plugins/formcraft/file-upload/server/content/files/160d0354fedcba---96623660562.pdfIn PDF document text
    • https://xn--64-mlcufjjaii0l.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/7f6af8057c6421ff606666d2d1579a44/63989913164.pdfIn PDF document text
    • http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607eac8acadab---32708585187.pdfIn PDF document text
    • https://functionalmovement.gr/wp-content/plugins/super-forms/uploads/php/files/6d250b61a7685074faf54b269afa8c64/zitasejifajavuda.pdfIn PDF document text
    • https://hanyauntuktesting.com/contents//files/18075413245.pdfIn PDF document text
    • http://fantasypartyentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/161252b24a0c77---lixojoxidodevari.pdfIn PDF document text
    • https://loctra.net/userfiles/file/kamidatunagijili.pdfIn PDF document text
    • https://osakaav.com/userfiles/files/kesigufizetudezezupin.pdfIn PDF document text
    • http://queuemanagementsystems.com/wp-content/plugins/formcraft/file-upload/server/content/files/160700d50bf042---jepapaludevisoseve.pdfIn PDF document text
    • http://ticaproduce.com/ckfinder/userfiles/files/poxokororizefuxojujusasej.pdfIn PDF document text
    • https://selectwifi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c5531c4a1c6---wazipidopus.pdfIn PDF document text
    • http://transinfosoft.com/userfiles/file/39343106888.pdfIn PDF document text
    • https://asoriofrio.org/ckfinder/userfiles/files/72881063470.pdfIn PDF document text
    • http://fiumevivo.it/userfiles/files/53539604485.pdfIn PDF document text
    • https://luminex.pl/upload/file/82480866904.pdfIn PDF document text
    • http://banlinhkienlaptop.com/userfiles/file/69996718761.pdfIn PDF document text
    • http://www.tecnotrefg.it/wp-content/plugins/formcraft/file-upload/server/content/files/16132b1a4c3a8d---86523295636.pdfIn PDF document text
    • https://thewentworthco.com/wp-content/plugins/super-forms/uploads/php/files/oqgkn1ke0v3h7lpli5gqbpm69c/mokunu.pdfIn PDF document text
    • http://vetcasatenovo.it/userfiles/files/68176166097.pdfIn PDF document text
    • http://omatsuri.kr/data/userfiles/files/zikezikureja.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/Om9ozkHLxGw/uplcv?utm_term=2015+hyundai+elantra+limited+owners+manualPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD7C2 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000efd4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFD4 18344 bytes
SHA-256: edd72060b3566f4def7a47c7fcb5684141439be53055f99e4b5ab2d00024ad74
font_02_sfnt_off00011f6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F6C 11144 bytes
SHA-256: 57e26d43c1f7d5330422113616843b9db20cf5b2fcde1674c2fed9b06d6769cc

Open this report in the interactive analyzer, or submit your own file for analysis.