Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7578fd78eb61027…

MALICIOUS

PDF

89.4 KB Created: 2021-08-09 00:57:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-29
MD5: b5845bf647926e8ec50d9f2225b7efe1 SHA-1: cdb72bfc215f42ed7dce97b093cbe9f3e3dcf356 SHA-256: f7578fd78eb610276647a9c6009de1d85277c54c9fe021f02a84c6ebbe57a545
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous links to external websites, many hosted on compromised CMS platforms, suggesting a phishing or malware distribution campaign. The presence of PDF-specific heuristics like 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM' further supports this, indicating the document is designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crysiq.ru/uplcv?utm_term=luom+g10+driver+windows+10 PDF link annotation
    • http://www.publicitymailing.ie/wp-content/plugins/formcraft/file-upload/server/content/files/160bc7d022f485---kozugaririfoxub.pdfIn PDF document text
    • https://www.sudburyhighspeedinternet.ca/wp-content/plugins/super-forms/uploads/php/files/b80cb0737f0149b980c8ca03d4de5061/82594709791.pdfIn PDF document text
    • http://magooferta.pl/uploads/fck/file/lotarojiwebi.pdfIn PDF document text
    • https://utilitydiscount.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f39ce177e6---72436126084.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160774c50d1746---77743836817.pdfIn PDF document text
    • https://yziact.fr/wp-content/plugins/super-forms/uploads/php/files/eid5201fiofljuad8rr67fklia/78947730899.pdfIn PDF document text
    • http://cuhs1981.com/clients/8/82/82ca37c076ec4232796cb58ed009bb3a/File/domamujogoxoliminarefodig.pdfIn PDF document text
    • https://amagi.la/wp-content/plugins/formcraft/file-upload/server/content/files/16071958e30da7---81449071230.pdfIn PDF document text
    • http://cba60.com/clients/6/6c/6c2dd71b6188bc8e8f5adc6209c6f86c/File/sonedekagug.pdfIn PDF document text
    • https://sandalyecenneti.com/wp-content/plugins/super-forms/uploads/php/files/qtbcd30lcrh7kklm96lckp8njv/watevazukitemofilaniluzi.pdfIn PDF document text
    • https://nevisnews.com/userfiles/59301499733.pdfIn PDF document text
    • http://rchs1964.com/clients/5/58/580abc73d3aac4ea3a2bdd7c75327783/File/jabopifunonedirutokariten.pdfIn PDF document text
    • https://textosolutionslinguistiques.ca/upload/editor/file/66775786155.pdfIn PDF document text
    • https://murtenhof.ch/userfiles/files/sodadupuwakapo.pdfIn PDF document text
    • http://kystop.com/wp-content/plugins/super-forms/uploads/php/files/s6jk84bti31utstpp8cd78mqt4/253061782.pdfIn PDF document text
    • https://www.helmmsp.ca/wp-content/plugins/super-forms/uploads/php/files/2b7e388f40891098a49f0c7bdbef14ee/17023819295.pdfIn PDF document text
    • http://alsumiri.net/wp-content/plugins/super-forms/uploads/php/files/3a13fcdd299841b344d8e2c1ee734393/vapetera.pdfIn PDF document text
    • https://www.limratechnologies.net/wp-content/plugins/formcraft/file-upload/server/content/files/1609f7599b392b---59325740234.pdfIn PDF document text
    • https://www.medipratik.com/wp-content/plugins/formcraft/file-upload/server/content/files/160721c35ae460---kemefinivifixugivogivev.pdfIn PDF document text
    • https://chefinhogourmet.com/wp-content/plugins/super-forms/uploads/php/files/c1c14872e7a6e1f496a6d792d75d0677/7037239420.pdfIn PDF document text
    • https://ecef-groupe.com/wp-content/plugins/super-forms/uploads/php/files/ekha0sh4kt9lp1979d1bucdu10/bafiwutatamatosuwovapovin.pdfIn PDF document text
    • http://angelcabrera.com/FCKfiles/file/1025772486.pdfIn PDF document text
    • http://jatyn.cn/upfiles/202105/file/1621113353.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f93a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF93A 16800 bytes
SHA-256: 0502bebeaf8950413569a24b07612c8f41c07425447f239241a7701f6cf9a6f6
font_01_sfnt_off0001252b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1252B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00013d42.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13D42 10668 bytes
SHA-256: c867d6a8411a0d4ca91afaeb2847c3aa01aaf37f70be74e30d6856e24514791c

Open this report in the interactive analyzer, or submit your own file for analysis.