Malicious PDF — malware analysis report

Static analysis result for SHA-256 de0baab647eb9038…

MALICIOUS

PDF

76.0 KB Created: 2021-08-13 13:46:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: 201ead230fe242d51c3d00e5d8674c25 SHA-1: 59084cb2f9be3751b1b75e7493814d0d9468b4e1 SHA-256: de0baab647eb90381f79d3cddc223cdcadad26a38fd00bc0c3f84b9509d54375
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan distribution attempt. It contains numerous links to external websites, many hosted on compromised CMS platforms or disposable domains, suggesting a link farm designed to redirect users to malicious content. The presence of multiple PDF_SEO_DISPOSABLE_LINK_FARM and PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM heuristics further supports this attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/uplcv?utm_term=ater+traduire+en+anglais+linguee PDF link annotation
    • http://keystoparadise.com/userfiles/files/tizogofejowetazuxilotal.pdfIn PDF document text
    • http://le-lemniscus-incandescent.fr/ckeditor/upload/files/13273281720.pdfIn PDF document text
    • https://greyquotient.com/wp-content/plugins/super-forms/uploads/php/files/0b088db8b4bb5af7572b74e39c4cf289/lozotipekelozivupefidagux.pdfIn PDF document text
    • http://www.uvhk.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aceeccc2a0d---61659940577.pdfIn PDF document text
    • https://mls.lighting/wp-content/plugins/super-forms/uploads/php/files/af1b719f2effae884976aaabc08a6189/mamikulidotatejaxuluz.pdfIn PDF document text
    • https://likeevent.it/writable/public/userfiles/file/19147982379.pdfIn PDF document text
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/82kvo4crovor67bgg9jas5f564/41641995319.pdfIn PDF document text
    • https://www.temsilcisitesi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f00490a1301---wokesomalepijifuw.pdfIn PDF document text
    • https://allianztc.ro/files/file/14988175066.pdfIn PDF document text
    • http://objetivovender.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070384aa41ac---polamopajigomirebupo.pdfIn PDF document text
    • https://ikuseikyokai.jp/ckmedia//files/96412591101.pdfIn PDF document text
    • https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bd702461577---sivoditaziti.pdfIn PDF document text
    • https://flvirginia.com/wp-content/plugins/super-forms/uploads/php/files/cd59a51adeb52a5e11635c08229eeea9/sajukuxateme.pdfIn PDF document text
    • http://conroeclassof72.com/clients/d/de/de0acc14889d5d69ce6a2e221f3e79cd/File/99981917276.pdfIn PDF document text
    • http://krevue.cz/UserFiles/File/katijewujimu.pdfIn PDF document text
    • https://siyata.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/160c85dd4ca9e3---vajab.pdfIn PDF document text
    • http://studiorestagno.eu/userfiles/files/39164392737.pdfIn PDF document text
    • https://www.indee-r.fr/wp-content/plugins/super-forms/uploads/php/files/f41878ba133d2f1105cfb99645bd326c/lipilorisuzuzodawewakol.pdfIn PDF document text
    • https://nceptionsolutions.com/wp-content/plugins/super-forms/uploads/php/files/7549e86448017de0ba942cba3f5241aa/bofikekosevolimudod.pdfIn PDF document text
    • https://benqmusicworkshop.com/fupload/file/nelugabupi.pdfIn PDF document text
    • http://eska-lift.ru/userfiles/file/pefuvodokozodivavivifun.pdfIn PDF document text
    • http://mas.vacations/wp-content/plugins/formcraft/file-upload/server/content/files/16096818d5b45c---majirabomoleka.pdfIn PDF document text
    • https://www.wflorlando.com/wp-content/plugins/super-forms/uploads/php/files/4b2c6d65ad8d380712f8ba858d61f885/38709208932.pdfIn PDF document text
    • http://snookerfootball.eu/wp-content/plugins/formcraft/file-upload/server/content/files/16084eff11e42b---85176811675.pdfIn PDF document text
    • http://kioskcondoweb.wpengine.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610c5c8c0a8d8---35278671463.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c642.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC642 10384 bytes
SHA-256: 2b91a0ca87b5a5ffde82e169c8b0510fd23f25b705ee1e70a0b4fd78610bfa21
font_01_sfnt_off0000dda5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDA5 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0000f5b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5B7 16788 bytes
SHA-256: 6a9ac265e7f25adbde370b59048db19a6033a05111747532e58059432a82c023

Open this report in the interactive analyzer, or submit your own file for analysis.