Malicious PDF — malware analysis report

Static analysis result for SHA-256 f337436d35282b3d…

MALICIOUS

PDF

81.4 KB Created: 2021-08-07 14:28:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: cdfca7160c19dd3f64ada327c71530c5 SHA-1: ea19bd205601bc62eab542c008cf3bafaad038e1 SHA-256: f337436d35282b3d6f1c3a83407bfaf40dd0906712ec968e5245dff7d89b7028
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF sample was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains embedded JavaScript and functions as a link farm, redirecting to various domains, some of which appear to be compromised WordPress sites. The primary attack pattern involves luring users through a malicious attachment to a site that likely hosts further malicious content or phishing forms.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cardion.dk/gfx/fckimages/file/69476144044.pdf In PDF document text
    • http://www.mvdisposal.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608622836893f---42363709390.pdfIn PDF document text
    • http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/79a811uh17md04q5tv62solar0/mibozotumozosefikelovewip.pdfIn PDF document text
    • https://avis-medical.ma/wp-content/plugins/super-forms/uploads/php/files/c865825207f67e7b059f036ca2ffe780/lumujadak.pdfIn PDF document text
    • https://hoalavender.net/upload/files/tovezikevenafimabama.pdfIn PDF document text
    • https://cpc-serbia.org/js//files/zalafevim.pdfIn PDF document text
    • http://infrabud.eu/fckpliki/file/bumuvivinokulinemavak.pdfIn PDF document text
    • https://feldmann-spedition.de/pics/userfiles/file/penofewakutejusuzewifas.pdfIn PDF document text
    • http://shinies.ru/img/lib/file/84316894076.pdfIn PDF document text
    • https://calldidocta.com/wp-content/plugins/super-forms/uploads/php/files/a5b7861b7a02d41f1c1b13431106bcd2/patufip.pdfIn PDF document text
    • http://inventory-acepipe.com/images/uploads/files/17743395817.pdfIn PDF document text
    • https://www.tessilgiada.it/wp-content/plugins/formcraft/file-upload/server/content/files/160a481cfeb8b5---gujagivozenilasi.pdfIn PDF document text
    • http://novaserv.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f4ea5090fdf---xumorexupi.pdfIn PDF document text
    • http://ingpiazza.eu/userfiles/files/detonuboxogoma.pdfIn PDF document text
    • http://www.phsdcenter.com/temp/js/ckfinder/userfiles/files/nejaduk.pdfIn PDF document text
    • https://greshamgilessalon.com/wp-content/plugins/super-forms/uploads/php/files/ecf90e74e004cff193df858ae7a1acf4/96528291320.pdfIn PDF document text
    • https://svetpoznaniyaonline.ru/wp-content/plugins/super-forms/uploads/php/files/a6f3582b4376c6a819f8258bc2f6e608/39825181443.pdfIn PDF document text
    • http://alexandercdg.com/clients/36029/File/segogabovigip.pdfIn PDF document text
    • https://cncunse.com/d/files/vunemixujar.pdfIn PDF document text
    • https://daluxerealty.com/wp-content/plugins/super-forms/uploads/php/files/mk2qlouuikh25mscng0v4jqq47/dofobavuxaduzarekujili.pdfIn PDF document text
    • http://cpspcb.com/uploads/files/wogupevavuvosobufejuninaf.pdfIn PDF document text
    • http://joesservicecenternj.com/userfiles/files/sidinixobafevalugefu.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=organometallics+and+catalysis+an+introduction+manfred+bochmann+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d859.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD859 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000f06b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF06B 16944 bytes
SHA-256: ab2b31751f5c2f83c7dbc7917e3c67ce115d65d82efc0dfdce8d7ddfd355305c
font_02_sfnt_off00011c7a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C7A 11448 bytes
SHA-256: f552ee2ea5b678553e5a8d213b00771616941c5fec072692bc72af5508d8a8c5

Open this report in the interactive analyzer, or submit your own file for analysis.