Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea3dad3bbf516a70…

MALICIOUS

PDF

201.4 KB Created: 2021-06-30 22:47:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: 829c4f35c7f1fd3a5b82970fd042c8db SHA-1: 3cf2169516ec3efa7cddbf760ed0495e26129c83 SHA-256: ea3dad3bbf516a70f1cfd213797bd6eb2bdb4658b22f2d77a013f2f1e8d22281
166 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains multiple links pointing to compromised CMS uploads and SEO redirectors, suggesting a phishing or malware distribution scheme. The presence of external URIs and link farms indicates an attempt to direct users to malicious content, likely for initial access via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7875

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://veivel.com/userfiles/file/43858425359.pdf In PDF document text
    • https://laxmigrouppune.com/wp-content/plugins/super-forms/uploads/php/files/4b8b5984d5d22b971dde2e7008903227/dasef.pdfIn PDF document text
    • http://change4best.ru/upload/file/noliredijusade.pdfIn PDF document text
    • http://multiseal.com.ph/wp-content/plugins/formcraft/file-upload/server/content/files/16079dc18b8a15---sinafujafopukinenetasisa.pdfIn PDF document text
    • https://rendiamovisibiliglinvisibili.org/file/29482275599.pdfIn PDF document text
    • http://www.siscard.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f9ac2685c4---rasukelojoxonomekovarixod.pdfIn PDF document text
    • https://www.ideaklinikkadikoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/16091e08838d6c---zobim.pdfIn PDF document text
    • https://unique-u.biz/images/uploads/file/sesarafab.pdfIn PDF document text
    • https://www.simplythebestevents.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160a86874c5956---25446423460.pdfIn PDF document text
    • https://loan-financial.com/wp-content/plugins/super-forms/uploads/php/files/ae12b756963a054222728baab6683513/29179484642.pdfIn PDF document text
    • http://omeofest.eu/userfiles/files/rovuzidijofed.pdfIn PDF document text
    • http://www.belladermeestetica.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607e167b8f298---kidubekefat.pdfIn PDF document text
    • https://kajariaadsevents.com/admin/uploads/file/79717100760.pdfIn PDF document text
    • http://subventionsbetrug.de/wp-content/plugins/super-forms/uploads/php/files/5v041cn97ls2ii6foifq8l3ned/luzituxobamuxeriguma.pdfIn PDF document text
    • http://archimax.ch/dynamic-images/cms/file/34337584904.pdfIn PDF document text
    • http://www.aamuhsv-madisonalumni.org/files/files/91672292413.pdfIn PDF document text
    • http://files.ibiza-ferien.de/file/lapugedizoxavixivu.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b0b578b43c5---xokomafenetewozovedar.pdfIn PDF document text
    • http://strap.sk/uploads/files/32376843813.pdfIn PDF document text
    • http://syuncyoku.jp/upload/file/7735103984.pdfIn PDF document text
    • https://www.gasserbush.com/wp-content/plugins/super-forms/uploads/php/files/4846455a5f53b8f11cfa84a4c8d832df/jivulexizonoribido.pdfIn PDF document text
    • https://snabavto.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084f1f2363b1---tirupufitusa.pdfIn PDF document text
    • https://adm.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/65af247c36a08b4138b51b7466638548/53302486014.pdfIn PDF document text
    • http://allaboutdowney.com/userimages/kalepone.pdfIn PDF document text
    • https://www.ideaklinik.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c79691dc51---raxaxasedasiz.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/FevRqgeaUVY/uplcv?utm_term=rules+of+survival+obb+filePDF link annotation
    • https://sharpspringwww.kinsta.cloud/wp-content/plugins/super-forms/uploads/php/files/82c1cca48f394379b808f86b633e8a88/89739086630.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016c4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16C4E 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0001845f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1845F 16160 bytes
SHA-256: 27fa49ca30b1f57c6e4f8b99ad1f73ead7010ce1f191e20d716503af09158f46
font_02_sfnt_off000199d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x199D1 125636 bytes
SHA-256: 416de2de366148e57a0791003ac3d66908ee9c0f8be035a4f22763f723c76341
font_03_sfnt_off0002ce65.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CE65 18576 bytes
SHA-256: aa8f1bb694678d1e5ce433747883ccb17d989380272a678c1fbf13836120de1a
font_04_sfnt_off0002ff95.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2FF95 10356 bytes
SHA-256: 9c3c81eadb357a3eab81cdf8f21bb21d15fddc54739c8c2f74c1c18db3f118a6

Open this report in the interactive analyzer, or submit your own file for analysis.