Malicious PDF — malware analysis report

Static analysis result for SHA-256 d65df10c01716943…

MALICIOUS

PDF

92.7 KB Created: 2021-08-18 07:30:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: 94b83a6a4117d16bcca4b8923a85af97 SHA-1: 3369ae51200fdf715dd9223ccf6525754fa95c98 SHA-256: d65df10c017169436111b0969235f8a5740bd6bb4d5603c3b31b8b5bd7bfe61a
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains embedded JavaScript and a large number of external links, many of which point to compromised CMS upload directories or disposable hosting, suggesting a phishing or malware distribution scheme. The embedded JavaScript likely serves to further the malicious payload or redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9866

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fenicia.uy/fenicia.com.uy/uploads/files/demudaberamulaveped.pdf In PDF document text
    • https://avenirpourtous.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1610079dd7531a---gupibonamujasajexet.pdfIn PDF document text
    • http://bertrandetgastineaudesigners.fr/userfiles/file/robenagipisupafimebedot.pdfIn PDF document text
    • http://www.chinahkcarplate.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070dda7789c0---gisikamifijupebodu.pdfIn PDF document text
    • http://scheiden-maassluis.nl/uploads//file/10606264169.pdfIn PDF document text
    • https://elsadaulte.com/ckfinder/userfiles/files/wawinegezorifubajujagow.pdfIn PDF document text
    • http://www.kocay.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160ddb9c826829---wuvejawo.pdfIn PDF document text
    • http://sakem.org/userfiles/files/78239393697.pdfIn PDF document text
    • http://skyrunarser.com/js/fckeditor/editor/filemanager/connectors/php/connector.php/upfiles/file/210714042027221548yhbg01.pdfIn PDF document text
    • https://forkidsvietnam.vn/wp-content/plugins/super-forms/uploads/php/files/oe6cjpqvjlvujp6e2t8sc0a0m6/ridowizuwilopujudari.pdfIn PDF document text
    • https://creteservices.com/FCKeditor/userimages/file/vogodezobuvagodidowumebof.pdfIn PDF document text
    • http://usmleworkout.com/files/file/46953213928.pdfIn PDF document text
    • https://gofropack.com/wp-content/plugins/super-forms/uploads/php/files/612dc93c1ab7ea81f146e0c594a66f63/47084005252.pdfIn PDF document text
    • http://improntediteatro.it/userfiles/files/diraxulebafijojoxid.pdfIn PDF document text
    • https://www.dekleinewerf.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160b08974ef092---sibagunu.pdfIn PDF document text
    • http://agiusfuneraldirectors.com/files/file/tadogasoximonexuminepu.pdfIn PDF document text
    • http://tinhdauvietnam.vn/upload/files/30395332338.pdfIn PDF document text
    • https://smilepaper.tw/archive/upload/files/vagulezemozifixabomidi.pdfIn PDF document text
    • http://agendaalzheimer.org/files/galeria/files/7752398759.pdfIn PDF document text
    • https://takiminsahada.com/wp-content/plugins/super-forms/uploads/php/files/282df50gr0ivlh0o2ac1hkqqlp/73610415152.pdfIn PDF document text
    • http://cageart.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16097e7842a7ec---91440724235.pdfIn PDF document text
    • https://refour.eu/wp-content/plugins/super-forms/uploads/php/files/021d76b5d08d6c0de1c4ab0391483f41/lokadebetuzuvuneb.pdfIn PDF document text
    • http://absolutelyneon.com/userfiles/file/99869155292.pdfIn PDF document text
    • http://mackyz7automotive.com/js/upload/files/27434762334.pdfIn PDF document text
    • http://esenkardeslerinsaat.com/resimlerfiles/kebixisuwaf.pdfIn PDF document text
    • https://proia.bg/userfiles/file/retuwugunolu.pdfIn PDF document text
    • http://ratchee.com/ckfinder/userfiles/files/wexoxojefajuvokote.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3CAf4wW3hvY/uplcv?utm_term=who+is+jake+in+one+of+us+is+lyingPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010557.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10557 17384 bytes
SHA-256: 80b6dafd8be6a70f139c9709236fdc60e884099213f45e9369063e8cde285fc5
font_01_sfnt_off000132f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x132F7 10724 bytes
SHA-256: 97063a3caf4185556c54903f65636d8ccbdfa396b4b64484931afb06382ad8f2
font_02_sfnt_off00014b8f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14B8F 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.