Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee65a69ef5c46c1b…

MALICIOUS

PDF

103.6 KB Created: 2021-06-26 00:10:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: f05b51d1c57ffb8d1521458e211d3f9a SHA-1: 77ba0879f67216d0c22fb4ed753aac6c1e9986da SHA-256: ee65a69ef5c46c1b102e14ec9b7bdcb630db0699b885b049ff259e7bc4f4f9aa
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and ML classifier indicated a high probability of maliciousness. Heuristics reveal it functions as a link farm, directing users to multiple compromised WordPress sites and potentially disposable hosting. These links are likely intended to host phishing pages or further malware payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9926

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lichnyiybrand.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160711f32ab731---18925155823.pdf
    • https://pfhotel.gr/ckfinder/userfiles/files/94488346780.pdf
    • https://drmiamiconnect.com/wp-content/plugins/super-forms/uploads/php/files/b65dba83319d741c6459041bd7068053/roxapamesavusoporef.pdf
    • https://agrotehholding.ru/wp-content/plugins/super-forms/uploads/php/files/6916c1f04d3445b54d22f6b0f057b768/fawuvepe.pdf
    • http://cgt-fo-csc.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160d62092516bb---tagagibakibuk.pdf
    • https://californiaoptionsrealestate.com/wp-content/plugins/super-forms/uploads/php/files/395fe3eacd762c803328fbd9b95751e8/bowiwomiwiboworibevosaxag.pdf
    • http://www.pirac.org/wp-content/plugins/super-forms/uploads/php/files/2308340e7554296bfb31edf50d8f79ea/fawepexoduretukegefe.pdf
    • http://rjbmachinery.com/d/files/80362178241.pdf
    • http://asesoriagarpe.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077d8e3a7095---43044636830.pdf
    • https://www.simcoerecovery.net/wp-content/plugins/super-forms/uploads/php/files/s9qgj5ifnpj8oppi7kran2g0q3/pabalikakimilug.pdf
    • https://christianboudreau.com/wp-content/plugins/formcraft/file-upload/server/content/files/160be86570c660---76724485281.pdf
    • http://endustriyelkiralama.com/wp-content/plugins/super-forms/uploads/php/files/sjok80omvhacsvn47emp9h96l8/gatukalomagubekatupufi.pdf
    • http://www.cascinasorigherio.it/wp-content/plugins/formcraft/file-upload/server/content/files/160c5d7b55bd18---milefunanupikuwinagimu.pdf
    • https://www.ibyservice.com/wp-content/plugins/super-forms/uploads/php/files/52d4e2d34b5bcef6c83dc204e55bf4a7/vikeresuvumolivawum.pdf
    • http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/1608a80a7455af---xesovumipago.pdf
    • http://www.nationaalgolfcongres.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1609f494e823ef---69388048590.pdf
    • http://szwygs.com/upload/tinejupe.pdf
    • http://asesoriagarpe.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cc971e6784---32011204740.pdf
    • http://travelshops.pl/userfiles/file/filegagumido.pdf
    • https://maloneslandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/16095ca3435a12---linutabazig.pdf
    • https://www.aserspa.net/wp-content/plugins/super-forms/uploads/php/files/i6p2og1omne9a7lgmva7qtrjsm/25880323402.pdf
    • https://xuantruongtech.com/images/ckeditor/files/letitevemijatavagedu.pdf
    • http://pck.malopolska.pl/wp-content/plugins/super-forms/uploads/php/files/034ca87fc0a941cd1e48209164a3d23f/soxegid.pdf
    • https://ahreco.com/uploads/news_file/79379829766.pdf
    • https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=how+much+do+4+month+old+puppies+sleep
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000131a1.bin
82eaff4abe54aa90ac019ad40460b6bb449ffa0e3581006f4048d3780b540aed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x131A1 17236 bytes
font_01_sfnt_off00015e4c.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15E4C 16792 bytes
font_02_sfnt_off00017663.bin
b2ecc1ddb2215da2b1589c243b00a8cc4dd9076bc5ad0553d8830710ef5a1392		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17663 10772 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.