Malicious PDF — malware analysis report

Static analysis result for SHA-256 edd2e6bdf8396cff…

MALICIOUS

PDF

88.7 KB Created: 2021-06-27 01:11:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: e92af028a347b891ae91244621c69a0d SHA-1: d328140d991f3ac9fb7a5a994b6f872d04f2cf6d SHA-256: edd2e6bdf8396cffe5d7c6127af4918deb12b0c6c8e28425f3b5cc0371b9e89d
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links pointing to compromised CMS uploads and disposable hosting, suggesting a phishing or malware distribution scheme. The presence of embedded URLs and the PDF_RANDOM_URL_LINK heuristic indicate attempts to redirect the user to external malicious content, likely for downloading a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9835

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://weilaimachinery.com/userfiles/files/pawigosuvaxosabuk.pdf In PDF document text
    • https://msr-hudsonproperties.com/wp-content/plugins/super-forms/uploads/php/files/1f5be73d8d3f17adff61ec2992b83d70/bemajawadas.pdfIn PDF document text
    • https://eduinfinite.com/wp-content/plugins/super-forms/uploads/php/files/234f964ac109f154c11a5da2991730a8/pekurexinigiluf.pdfIn PDF document text
    • http://sl-light.ru/design/img/upload/file/77210043367.pdfIn PDF document text
    • https://414movement.com/wp-content/plugins/super-forms/uploads/php/files/9e61c9f2a3d6df22ca25cb7e69601c06/jijamulebiredaxowisosi.pdfIn PDF document text
    • https://weblative.com/wp-content/plugins/super-forms/uploads/php/files/l0dcb0h8m9p0v98lssre97i44r/vudesewevewunatuwivu.pdfIn PDF document text
    • https://ambulatorioveterinariosismondi.eu/file/zejotebuwi.pdfIn PDF document text
    • https://mebelpozakazu.ru/wp-content/plugins/super-forms/uploads/php/files/ebb58b7acf2c5cbdabce47ca8188f314/36313903376.pdfIn PDF document text
    • http://dabaizhongxue.com/upload_fck/file/2021-6-26/20210626094313817174.pdfIn PDF document text
    • https://medicinasolidale.org/wp-content/plugins/super-forms/uploads/php/files/ba7cb2bb01500e30f6c2fabd573b5f04/62388482402.pdfIn PDF document text
    • http://riccaassociati.eu/userfiles/files/28109650021.pdfIn PDF document text
    • https://freshchannels.com/home/sites/freshchannels/public_html/ckfinder/userfiles/files/buzokumebulabuwaw.pdfIn PDF document text
    • http://moveisgarciadigital.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160bfa4520a16c---relupizike.pdfIn PDF document text
    • http://holzbau-napetschnig.at/lofarelirexugulafulu.pdfIn PDF document text
    • http://greathorserider.com/ckfinder/userfiles/files/diresamejetili.pdfIn PDF document text
    • http://3handseg.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080c3d571c0d---bofuzebiloxifopatidosapi.pdfIn PDF document text
    • https://joefairless.com/wp-content/plugins/super-forms/uploads/php/files/3d3ce07d50633fe62dd0a05046c8768f/fifuximajajume.pdfIn PDF document text
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b80169d5014---sofisosegisivomel.pdfIn PDF document text
    • http://recruiters-zone.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c9ef5040c44---71082021499.pdfIn PDF document text
    • http://mp-hd.de/data/aktualnosci_imgs/file/59618260584.pdfIn PDF document text
    • http://smit-electronic.hr/upload/datoteke/13844963944.pdfIn PDF document text
    • https://cvsc.co/userfiles/file/fegejavetefakuviko.pdfIn PDF document text
    • https://cashofferoregon.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a17a1818238---laropikupif.pdfIn PDF document text
    • https://senhewood.com/d/files/baxiwalu.pdfIn PDF document text
    • http://chagatea.ru/wp-content/plugins/super-forms/uploads/php/files/2f4e0526f06f1049862277a65a2631a2/79320433761.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BkSY9tpko7c/uplcv?utm_term=what+is+the+purpose+of+precis+writingPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f82c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF82C 17044 bytes
SHA-256: 47dddc05b2c01b4af8e687e85331c52d731150bc18bee87f74ab1a6ffe853e5d
font_01_sfnt_off000123e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x123E0 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00013bf7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13BF7 10892 bytes
SHA-256: ecfc09b424d5dc7868f11fc65fa0158acc0f56e2ac34f7dc4ce679ad449a40c3

Open this report in the interactive analyzer, or submit your own file for analysis.