Malicious PDF — malware analysis report

Static analysis result for SHA-256 f35c7c3bccb15ec7…

MALICIOUS

PDF

91.3 KB Created: 2021-06-27 02:43:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-13
MD5: 964989de5c1fd026bf93ef9fb9ad2265 SHA-1: 87f3bde7cdf97072f3ea9e0dbf0e3da37f073f28 SHA-256: f35c7c3bccb15ec7d4897c41980d1b363e3e00c47db73664f012a162ba436622
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded URLs, many of which point to compromised CMS upload directories. Heuristics indicate this is a link farm designed to redirect users, and ClamAV detection confirms its malicious nature. The ML classifier also strongly flagged this PDF as malicious, suggesting a phishing or malware distribution intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://benchmarktransitions.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609b8f5b1a5b2---34742990136.pdf In PDF document text
    • https://ailani.org/wp-content/plugins/super-forms/uploads/php/files/3955195430786691dae3b729727c10f7/kekotarigulitizurej.pdfIn PDF document text
    • http://www.lentilles-progressives.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1608a95646ec6e---reramiwelovaregifa.pdfIn PDF document text
    • https://intelean.com/wp-content/plugins/formcraft/file-upload/server/content/files/16091c67c6f286---mumekowobetek.pdfIn PDF document text
    • http://teenaramainc.org/clients/875997/File/41096164336.pdfIn PDF document text
    • http://graphicon.hu/wp-content/plugins/formcraft/file-upload/server/content/files/16071078603ee9---fizepuvixuk.pdfIn PDF document text
    • http://www.sg-callenberg.de/wp-content/plugins/formcraft/file-upload/server/content/files/1609e6c6261a94---lagagixizoxubanarevuseva.pdfIn PDF document text
    • https://centrobrands.com/wp-content/plugins/super-forms/uploads/php/files/8e07cf76ce42c746e2db24998ddce22a/noxukewijefazu.pdfIn PDF document text
    • http://ipvoicenj.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090b4c4b3ed2---nezoj.pdfIn PDF document text
    • http://bmcnx.com/userfiles/file/82892319753.pdfIn PDF document text
    • http://www.uvhk.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a3da6e4f343---pizojubabowojefosadi.pdfIn PDF document text
    • https://pfgmm.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160b20538a2186---kosefol.pdfIn PDF document text
    • http://vilaportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ba2e81a43d8---29619272375.pdfIn PDF document text
    • https://primax.fr/wp-content/plugins/super-forms/uploads/php/files/6tfh8qdc824a4kkg4jk6cvbpa6/welotadisetukezuze.pdfIn PDF document text
    • https://martybermanassociates.com/wp-content/plugins/super-forms/uploads/php/files/d1c3dfda0527ef632c6abca55b2b9742/62817270818.pdfIn PDF document text
    • https://www.birdandwildlifeteam.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aaa6e0d5602---rarojivexo.pdfIn PDF document text
    • http://www.psstrecno.sk/wp-content/plugins/formcraft/file-upload/server/content/files/16088efe77dce4---58500130215.pdfIn PDF document text
    • http://www.commandinglife.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bff723d82e5---sinomonuroso.pdfIn PDF document text
    • https://betonwerkendejonge.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160cb19e741346---luwunakijap.pdfIn PDF document text
    • http://www.magicapro.it/wp-content/plugins/formcraft/file-upload/server/content/files/1608e5cf5c0bad---dubimum.pdfIn PDF document text
    • http://businessplan-capalpha.eu/mbp/upload/images/images/upload/ckfinder/45039882625.pdfIn PDF document text
    • http://bjzjygj.com/fckeditor/editor/filemanager/connectors/php/userfiles/file/warobinufemujufonotise.pdfIn PDF document text
    • https://shinyjewellers.com/wp-content/plugins/super-forms/uploads/php/files/arfu7pj1tc6re166pc1akbo4jh/48086484207.pdfIn PDF document text
    • https://xn--80adj7cxa.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/1d3aacd9f6c07321affe641a960b99c1/3694713144.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3CAf4wW3hvY/uplcv?utm_term=canadian+business+directoryPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101FD 17320 bytes
SHA-256: 9f1d28d5ad21e2ef09604254a3d65536bbe0fa7d8998c19ca231e647f56a96db
font_01_sfnt_off00012f69.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F69 10704 bytes
SHA-256: 6798da474c7a2d4bd7cd909500aea886995cebfb867177d35f3bed4b57942ea3
font_02_sfnt_off00014829.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14829 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.