Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce34fe2e68e5eac7…

MALICIOUS

PDF

86.3 KB Created: 2021-08-14 01:12:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-22
MD5: a868b59bdaa8ba628a994cfff5901ebf SHA-1: 731324f3ae55b2ad212a00ccf9bc7cbb036a1cfb SHA-256: ce34fe2e68e5eac70556e6f4ade8598eec3126dec10e5d2f0306d37fd2429dba
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded JavaScript stream and numerous external URIs, many of which point to compromised or disposable hosting. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a pattern of using such PDFs to host a large number of links, suggesting a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://uetty.xyz/js/ckfinder/userfiles/files/46183705823.pdf In PDF document text
    • http://fitnessklub-impuls.pl/uploads/assets/file/36724499276.pdfIn PDF document text
    • https://refour.dk/wp-content/plugins/super-forms/uploads/php/files/8d525dd2560204f73d9b7dfb3a0ac931/63028898004.pdfIn PDF document text
    • https://kaxtongroup.com/home5/maxconne/public_html/kaxtongroup/assets/images/newspostimages/files/46947959412.pdfIn PDF document text
    • http://esistore.be/userfiles/file/kobilusarux.pdfIn PDF document text
    • https://detskeihriska.eu/ckfinder/userfiles/files/roliduzanadomofas.pdfIn PDF document text
    • https://www.northamericatalk.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b65b234fa54---59454991155.pdfIn PDF document text
    • http://dmn.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609aa32c6a86d---xitogomudut.pdfIn PDF document text
    • https://www.golaw.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b4c567b0295---nojukakiwekerik.pdfIn PDF document text
    • https://luxmarketing.agency/wp-content/plugins/super-forms/uploads/php/files/tupluqhnfq3j9epope2985780s/nefuletorawow.pdfIn PDF document text
    • https://www.intermediastudios.com.mx/wp-content/plugins/super-forms/uploads/php/files/9e4d4a70cd482a3411758f79fa8cba11/23311468077.pdfIn PDF document text
    • https://bettenbaehren.de/wp-content/plugins/formcraft/file-upload/server/content/files/160abb63448121---50440728170.pdfIn PDF document text
    • http://noahsmarinesurveyors.ca/userfiles/file/86799897762.pdfIn PDF document text
    • https://dreamscapes.ca/dream_scapes/userfiles/files/gelakixafututatezoj.pdfIn PDF document text
    • http://dobryremont.pl/ebobas/portal/app/webroot/img/tmp/file/16268065883951.pdfIn PDF document text
    • http://aranykoronakft.hu/userfiles/file/58318903792.pdfIn PDF document text
    • http://kirks-pool.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bfbf5c86cf6---84842448440.pdfIn PDF document text
    • https://szamitogep-szerviz-javitas.hu/ckfinder/userfiles/files/vetabomugufekonovivebiz.pdfIn PDF document text
    • https://wpsqld.com.au/wp-content/plugins/super-forms/uploads/php/files/efa455c502e6fe95965cc3e4ef9b2697/66891930395.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a9832aadf30---3467910094.pdfIn PDF document text
    • https://plumcourse.com/wp-content/plugins/super-forms/uploads/php/files/6c99e6dc60c69f910b28ac17e73d4802/zewepadof.pdfIn PDF document text
    • http://www.anclupnapoli.it/userfiles/file/25111280154.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=oraciones+yuxtapuestas+coordinadas+y+subordinadas+ejemplosPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA7B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0001028d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1028D 18100 bytes
SHA-256: 93d93bb24e8d77a94353783265cae47683453337f0b35bd08332073d6c071d24
font_02_sfnt_off000130bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x130BD 11284 bytes
SHA-256: 5afad7c3a7e1914ae965c69802186b67886c95f3467953d3996e2a28c6d8719e

Open this report in the interactive analyzer, or submit your own file for analysis.