Malicious PDF — malware analysis report

Static analysis result for SHA-256 e57413707ddfe3dc…

MALICIOUS

PDF

91.4 KB Created: 2021-07-07 19:05:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 93ed62b27f3cc7f22156e761b784c27d SHA-1: d8f286d77ce5711c3718a40a19d68bb7b9a7b577 SHA-256: e57413707ddfe3dc17b8ee6243e0bc38b1c94778dbc7ca6b3aee08e933e6429f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external URLs, many hosted on compromised CMS platforms, suggesting a link farm designed to redirect users to malicious sites. The PDF structure and embedded URLs point towards a phishing or malware distribution campaign, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9937

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/uplcv?utm_term=bible+verses+about+forgiving+others PDF link annotation
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a84d84d3d65---5087913952.pdfIn PDF document text
    • http://matstravel.ru/userfiles/file/mudixififusuzowiposo.pdfIn PDF document text
    • https://motionslam.com/wp-content/plugins/super-forms/uploads/php/files/66731ca735be138f92c4d41b9a5f052e/jarasunukumered.pdfIn PDF document text
    • http://www.medical-psychology.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160a8005d6957c---fefiwapatowaxalolebar.pdfIn PDF document text
    • http://permianhighschool1970.com/clients/e/ef/efee9fcbc667252fc4b649c8163d3733/File/zoxoj.pdfIn PDF document text
    • https://refour.dk/wp-content/plugins/super-forms/uploads/php/files/279defc8e2ebd2c8d7b5edfdce28de0e/duliruw.pdfIn PDF document text
    • https://aydin-elektrik.com/resimler/files/93180432854.pdfIn PDF document text
    • http://www.gametimecatering.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d085f4d1e4---84358596021.pdfIn PDF document text
    • https://www.bouwenaaneensterkwerkgeversmerk.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16071c50640341---24284491615.pdfIn PDF document text
    • https://onhimalayas.com/ckfinder/userfiles/files/78237900543.pdfIn PDF document text
    • https://primeodontorj.com/wp-content/plugins/super-forms/uploads/php/files/89528dbff2182ccf33a98be1cb05f80a/62260182487.pdfIn PDF document text
    • https://stagerightstaging.com/wp-content/plugins/super-forms/uploads/php/files/d644aa57b7c6c1404368f891136972c4/fulopedobukubi.pdfIn PDF document text
    • http://chromatographvials.com/d/files/jojarolopamozurow.pdfIn PDF document text
    • https://www.horisunmauritius.com/wp-content/plugins/super-forms/uploads/php/files/6e94623e5d55e836e05087081507384a/wojan.pdfIn PDF document text
    • https://mobistore.co.nz/wp-content/plugins/super-forms/uploads/php/files/58c7192664783284789916a2323ec9de/favilaxuxufufil.pdfIn PDF document text
    • https://christianboudreau.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a4bcd1c72b---doralolupebuso.pdfIn PDF document text
    • https://atlasautoglass.com/wp-content/plugins/formcraft/file-upload/server/content/files/160838f827ef12---wajebofixud.pdfIn PDF document text
    • https://west-holding.com/userfiles/file/vabikomesubomu.pdfIn PDF document text
    • http://zhengfutz.com/v15/Upload/file/2021628911112196.pdfIn PDF document text
    • http://www.grundys.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1609d49b7b7605---ponadugibazamevafujij.pdfIn PDF document text
    • http://cz-synergy.cz/data/file/2405229499.pdfIn PDF document text
    • http://www.sunarozlem.com.tr/wp-content/plugins/super-forms/uploads/php/files/cu9ru0chpd1t1snnr8jq053q66/42083424391.pdfIn PDF document text
    • http://www.driftime.ee/wp-content/plugins/formcraft/file-upload/server/content/files/160c18f711ccad---43659732403.pdfIn PDF document text
    • http://dolnoslaskialarmsmogowy.pl/imgturysta/files/verizavapaperowupekolaku.pdfIn PDF document text
    • https://directprocessors.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a4bb9d166a3---71683263221.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010321.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10321 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00011b38.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B38 10852 bytes
SHA-256: e30ef88cb519012a6eba08c55f9c378410ca68533ec26c2092c7481f22942f61
font_02_sfnt_off0001343d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1343D 16932 bytes
SHA-256: 223453c6644dfbadc7bffdf1aeae88f4c2570b6db09372fcb0983d5b463a1bc3

Open this report in the interactive analyzer, or submit your own file for analysis.