Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd5cea39a08c27fb…

MALICIOUS

PDF

79.2 KB Created: 2021-09-05 05:05:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-29
MD5: 4d6ab2aef983c5ab6be1c22e36d3c152 SHA-1: 0a01d03d2e0ac47907096e648a213fb83c4bc7b2 SHA-256: cd5cea39a08c27fb8ebdd9964d4cfd688e94f3551715b78e0fac9e16e5a1dfcf
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous links to external websites, many of which are hosted on compromised CMS platforms or appear to be part of a link farm, suggesting a phishing or malware distribution scheme. The PDF structure itself does not contain readable content, but the presence of external links and the high detection scores strongly point towards a malicious document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9917

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.dynasil.com/wp-content/plugins/super-forms/uploads/php/files/8c8f7f2b3ed297b6307a5a8ee645d1ae/dekixifibenadixewubara.pdf In PDF document text
    • http://goteneplast.se/files/images/file/13893361171.pdfIn PDF document text
    • https://tlpnw.com/wp-content/plugins/super-forms/uploads/php/files/b6b51253319f5a21e3c5450f878bb306/49376499015.pdfIn PDF document text
    • https://costumeworld.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084eac281b90---95384530225.pdfIn PDF document text
    • http://kondicionery-lubertsy.ru/upload_picture/file/vedapilaj.pdfIn PDF document text
    • https://www.azulejositurry.com/wp-content/plugins/super-forms/uploads/php/files/s4644scqs05rta5ncuqdsnsal1/74140472404.pdfIn PDF document text
    • https://www.bbmnetlicitacoes.com.br/cms/ckfinder/upload/files/rofelexores.pdfIn PDF document text
    • http://elesi.eu/fichiers/files/58301804892.pdfIn PDF document text
    • https://laihouston.com/wp-content/plugins/super-forms/uploads/php/files/79d978d10e3ec9abb25a542b5b5c2194/degubowejuna.pdfIn PDF document text
    • https://action-roofing.com/wp-content/plugins/super-forms/uploads/php/files/8950ccb75d4114826cf4ba929d1c311e/baxamuwojujutut.pdfIn PDF document text
    • http://www.sname.org.tw/sname/ckfinder/userfiles/files/46787011978.pdfIn PDF document text
    • https://postscriptproductions.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c93c2d245f---worumurafewetisu.pdfIn PDF document text
    • http://becucci.it/userfiles/files/zajexegubigetubifa.pdfIn PDF document text
    • http://www.jcca.co.in/wp-content/plugins/formcraft/file-upload/server/content/files/160817149a6f23---muxaj.pdfIn PDF document text
    • http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/160713d2e5bb45---gobetojiwufosa.pdfIn PDF document text
    • http://ebiocell.com/uploadfile/file///2021062019100577.pdfIn PDF document text
    • https://srmhomes.com/images/bulk_images/files/sanoxafaroruxaf.pdfIn PDF document text
    • http://iamsoldierfit.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071e965ef1f5---74726958394.pdfIn PDF document text
    • https://anaksemut.com/contents//files/28065354535.pdfIn PDF document text
    • http://teresachild.com/upload/files/suvem.pdfIn PDF document text
    • https://webmenuplus.com/images/file/40364364078.pdfIn PDF document text
    • https://pankalconstructora.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d5b605a894---62421953974.pdfIn PDF document text
    • https://adbetelparaguay.com/wp-content/plugins/super-forms/uploads/php/files/358ec68435ff25f00c07261bfc8bbee5/2617986215.pdfIn PDF document text
    • https://ncfouting.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bdbafd766f8---vofokokebonodifesajiwuze.pdfIn PDF document text
    • http://jagatjyotischool.org/jagatjyotischool/userfiles/file/toberifefifekipitotoxup.pdfIn PDF document text
    • http://americanpetrochemicals.com/customers/CMS-IMAGES/file/madoxokegoguzabadavufilu.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/cv9VXjIrmdE/uplcv?utm_term=3rd+grade+math+rounding+to+the+nearest+ten+worksheetsPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d09c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD09C 11004 bytes
SHA-256: faf2f75c5a72dc6b6c78819de23a765adcacac0b8551eb4cfe30f829e459e95b
font_01_sfnt_off0000e9de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9DE 17888 bytes
SHA-256: 556787207726bc87fa5403b9e84c4907a684c9c41d5c1f2703e76313e74e6e46
font_02_sfnt_off00011680.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11680 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.