Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0f0435fac40d57a…

MALICIOUS

PDF

135.5 KB Created: 2021-07-03 01:10:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25
MD5: 4a5d2999dc95d8cc7a801eaeb5854d7c SHA-1: f79431b415e5371e03fbc83ca430aa133f6b7c0e SHA-256: d0f0435fac40d57a5de5158f2037e0840eaafcecd29e57cc52f90bb65dacd891
264 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1553.005 Security Software Installation T1219 Remote Services

This PDF document exhibits multiple high-risk heuristics, including a ML classifier flagging it as malicious and ClamAV detecting it as a phishing trojan. The document's content strongly suggests a social engineering attack, instructing users to disable security software and install remote support tools, which is a common precursor to unauthorized access or further malware deployment. The presence of numerous embedded URLs, many pointing to potentially compromised or disposable hosting, further supports a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9474

Heuristics 10

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Security software disable instruction high SE_SECURITY_BYPASS
    Document instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://atamergranit.com/userfiles/file/30181767449.pdf In PDF document text
    • https://cutletsmeat.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071369073f09---gaxunejujurogewis.pdfIn PDF document text
    • http://envigest.cz/upload/file/vuwatutiloduko.pdfIn PDF document text
    • https://tahitotfaluovodak.hu/ckfinder/userfiles/files/wunonoxufija.pdfIn PDF document text
    • http://tara77.com/clients/46590/File/60037407893.pdfIn PDF document text
    • https://ecomassage.pt/wp-content/plugins/super-forms/uploads/php/files/0g6i82e1kam87ikiiolkapf2au/28734490884.pdfIn PDF document text
    • http://sequirk.ie/userfiles/file/35756057753.pdfIn PDF document text
    • http://localhomesales.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1608cb38cde092---tefufizisiwor.pdfIn PDF document text
    • http://eprdel.cz/userfiles/file/vibuloforofuwipuzulufe.pdfIn PDF document text
    • http://premium-t.info/files/files/24663134169.pdfIn PDF document text
    • https://ntwbearing.com/UserFiles/File/peranimarazexuwemidar.pdfIn PDF document text
    • http://www.fliesen-brill.de/wp-content/plugins/formcraft/file-upload/server/content/files/16099d8b1bb01d---76851694040.pdfIn PDF document text
    • https://twr1115.net/files/fckeditor/file/dabobatalagusuzi.pdfIn PDF document text
    • https://wemservice.com/ckfinder/userfiles/files/gukojinivoritijoj.pdfIn PDF document text
    • http://brandnewgoods.net/userfiles/file/zenixetivakezarinojag.pdfIn PDF document text
    • http://emilygrilltogo.com/uploads/files/57111987273.pdfIn PDF document text
    • https://srp-galabau-rostock.de/wp-content/plugins/super-forms/uploads/php/files/k5paqgf4bcvshc8k1eksv8hhu6/99234355420.pdfIn PDF document text
    • https://www.quatainvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b5aec136957---7650956690.pdfIn PDF document text
    • http://accessiblevehicleservices.com/userfiles/file/wugogox.pdfIn PDF document text
    • https://rajaketiga.com/contents//files/5186532710.pdfIn PDF document text
    • https://floorco.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/da9be82cc356e7721cafcb2503425f1a/desalasezajos.pdfIn PDF document text
    • http://zabradli-znerezu.cz/userfiles/file/japivoludobezukuzufov.pdfIn PDF document text
    • https://elitteaccesorios.com/wp-content/plugins/super-forms/uploads/php/files/svrpp5dol11m5di9ebrhh228v8/42146152732.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/ngfLrbzwjls/uplcv?utm_term=sharkboy+and+lavagirl+full+movie+freePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017c35.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17C35 16140 bytes
SHA-256: 00b1f632e8afe72716c8bcdb76b7901b56c060d1dc0f96f3f5c1b8373b85735b
font_01_sfnt_off000191ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x191AD 30016 bytes
SHA-256: 69ef4416673553a0e518ab743733d7390bd4c64518acc92a239d2604756665ba
font_02_sfnt_off0001d4ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1D4ED 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off0001ecfa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1ECFA 1940 bytes
SHA-256: c3a44c7f37f7fb08a64e2d81abbaf1c85655a7a4a1e1a9fab0834bf941b0afcd
font_04_sfnt_off0001f5dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F5DD 11124 bytes
SHA-256: e7440bc5212b8f3dac0e4f0ead1b8ce898271658adedcdf905610dc1c1114a6b

Open this report in the interactive analyzer, or submit your own file for analysis.