Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd6886563bcf23e3…

MALICIOUS

PDF

81.7 KB Created: 2021-07-29 18:48:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: 0ac11df75252bd58b263e5e1e0202ff0 SHA-1: 7d7395151e42562a6df6cb7c1a1894e8e020182b SHA-256: dd6886563bcf23e39bb3f4aa9b8a7aa7ad63c0c3e274c88d5b2d9cdb0a3cc0fa
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was flagged by multiple heuristics as a link farm, with many URLs pointing to compromised CMS upload directories. The ML classifier and ClamAV also identified it as malicious, specifically a phishing trojan. The file's structure and embedded links suggest an attempt to lure users to external sites, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9782

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aberdeeneyes.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1609f69a6875ee---46835209619.pdf In PDF document text
    • http://fotofolliasanlazzaro.it/userfiles/files/rorumuvugasobe.pdfIn PDF document text
    • https://roadtoring.com/wp-content/plugins/super-forms/uploads/php/files/361dfccce3a5623d91ee980859f424d7/liruraranaxadep.pdfIn PDF document text
    • http://gadkowski.pl/repository/filemanager/file/34364930674.pdfIn PDF document text
    • http://winkeleninzundert.nl/uploadimages/files/25901439917.pdfIn PDF document text
    • https://zold-kommando.hu/files/87056550398.pdfIn PDF document text
    • http://www.nanodrywash.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c264af749c2---19024130400.pdfIn PDF document text
    • http://osheamaloneynylaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/68604113606.pdfIn PDF document text
    • http://hondasushi.com/uploads/files/zazeronasibakufa.pdfIn PDF document text
    • http://zaintik.org/files/galeria/files/finopujefanebuko.pdfIn PDF document text
    • http://saludocupacionalpso.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/1608c6baaba1ad---rinaxepowikavofofoje.pdfIn PDF document text
    • https://dfa-finanz.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607e5e0220d2a---68133458025.pdfIn PDF document text
    • http://czdashan.cn/uploadfile/file/2021050603515773499.pdfIn PDF document text
    • http://www.kinoimaging.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160b22392689c1---mikuwaselopunazajamete.pdfIn PDF document text
    • http://familiehollander.nl/images/uploadedimages/file/baxulot.pdfIn PDF document text
    • http://futuralagoparking.eu/userfiles/files/figinaw.pdfIn PDF document text
    • http://ankamet.com/userfiles/file/70041637170.pdfIn PDF document text
    • https://iword.de/userfiles/file/mefinifuxip.pdfIn PDF document text
    • https://www.kngroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609e1904c8590---18454070027.pdfIn PDF document text
    • https://www.eoluk.com/wp-content/plugins/super-forms/uploads/php/files/c3qd9fh3mse9hjban126fk869a/puzojibumepezugata.pdfIn PDF document text
    • https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/160ad7fdedf9ae---tesil.pdfIn PDF document text
    • http://mujuerp.com/uploads/ckeditor/files/20210601175139.pdfIn PDF document text
    • http://fashioncenterpoint.com/wp-content/plugins/super-forms/uploads/php/files/0c3981a4b8bbddec106fa59269302a75/welapavofi.pdfIn PDF document text
    • http://baanpowertrain.com/wp-content/plugins/formcraft/file-upload/server/content/files/160858aacdd304---69547998602.pdfIn PDF document text
    • http://perles-del-beya.com/userfiles/file/56540590693.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=what+is+10st+in+lbsPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f008.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF008 14828 bytes
SHA-256: e33f342f8235eb86843ad5064f13a9ef38ff8e874a1606c3c847e478dcb3f6d4
font_01_sfnt_off000115b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x115B7 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00012dce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12DCE 10160 bytes
SHA-256: e534b063820dd010c790ae76efb2c5bbe56a1396276d258072a34c71d3eeb883

Open this report in the interactive analyzer, or submit your own file for analysis.