Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce994e998788af95…

MALICIOUS

PDF

86.4 KB Created: 2021-06-27 12:02:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: d06fe6e2607bacc809467f808b42a0da SHA-1: eda488c2d8e0b325335e025f2b76d0254d4284b9 SHA-256: ce994e998788af95398a9d24d669b8b1aa252db4f05c86e3b92d33f2ebbc73b6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external links, many pointing to compromised WordPress sites and disposable hosting, suggesting it functions as a link farm to distribute malicious content or phish users. The presence of external URIs and link farms strongly suggests an attempt to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9966

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/uplcv?utm_term=white+aphid+bug PDF link annotation
    • https://www.die-umzugsfabrik.com/wp-content/plugins/formcraft/file-upload/server/content/files/16085e9678629a---darukolo.pdfIn PDF document text
    • https://www.accidentinjuryalbuquerque.com/wp-content/plugins/super-forms/uploads/php/files/b8t94kv50val4rb5ia9m6el19d/gisexe.pdfIn PDF document text
    • http://thanhlamresort.vn/wp-content/plugins/formcraft/file-upload/server/content/files/16077cca4253aa---mifawexuvod.pdfIn PDF document text
    • http://ufnk.fr/app/webroot/files/file/vipogagobe.pdfIn PDF document text
    • http://netisiletisim.com/guvennet/resimlerfiles/saminoxinuxejugejipuduv.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b17a2191d83---zefikojalarovituzatumifi.pdfIn PDF document text
    • https://transit-connection.com/userfiles/files/jufewupemig.pdfIn PDF document text
    • https://spazmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ba3c4d36c86---78043200984.pdfIn PDF document text
    • https://hanahana.vn/media/ftp/file/20723656991.pdfIn PDF document text
    • https://www.rockandroll.blog.br/wp-content/plugins/super-forms/uploads/php/files/k01aj706k6sk33mdn53qpk163k/sobesix.pdfIn PDF document text
    • http://novichiha.ru/pic/file/77298572982.pdfIn PDF document text
    • http://chiangmai-clean.com/user_img/files/45313163167.pdfIn PDF document text
    • https://alignerco.com/wp-content/plugins/super-forms/uploads/php/files/a6a2ed1f15689d3226535afd06f7a02b/bekozeneziwejatobeminol.pdfIn PDF document text
    • https://www.demetagras.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cbd0342754---82948718775.pdfIn PDF document text
    • http://gopherandsquirrelcontrol.com/admin/images/file/fojemav.pdfIn PDF document text
    • https://fietenhaardenenkachels.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c1985933ad4---24426056189.pdfIn PDF document text
    • http://archgeo-leszno.pl/uploads/userfiles/files/82519667260.pdfIn PDF document text
    • https://hospvetcentral.pt/site/upload/file/32497381077.pdfIn PDF document text
    • http://bagandpack.ru/wp-content/plugins/super-forms/uploads/php/files/9876e280c217af9e7ed766586c8b9312/91638408085.pdfIn PDF document text
    • https://www.medipratik.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607dec521b1e2---dofotofusotir.pdfIn PDF document text
    • http://zuche0551.com/upload/file/42510740910.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3D0 10364 bytes
SHA-256: 93d6981e6baa21383317e885e12eb9f1c76dce6f2c4489069b86931fadf0e064
font_01_sfnt_off00010ae6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AE6 16160 bytes
SHA-256: 4c309a371d74c1df10eaa7c4d7e7ae14a16f85c0f39f123e6bb6a9b2e23557df
font_02_sfnt_off000134c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134C1 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.