Malicious PDF — malware analysis report

Static analysis result for SHA-256 f937a33ef008eed7…

MALICIOUS

PDF

92.2 KB Created: 2021-08-04 02:48:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: d1a76516249e9dc874c04fcb8bd26238 SHA-1: 8074b9f8ef91d2fb6fe594f5c189cef81144da70 SHA-256: f937a33ef008eed7442e824babecd3cc710c047fffe6dd2b5ac01e70794dd6e9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file is a PDF that contains numerous links, many of which point to compromised WordPress installations. The ML classifier and ClamAV detection strongly indicate maliciousness, specifically a phishing or trojan threat. The PDF's structure as a link farm suggests it's designed to lure users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://drvision.org/wp-content/plugins/formcraft/file-upload/server/content/files/160bda4453736b---sumalotubemerafijajog.pdf In PDF document text
    • https://www.phoenixdentalacademy.co.uk/wp-content/plugins/super-forms/uploads/php/files/641df06b5c1bb6f2b8dbbfa097cca694/48818378359.pdfIn PDF document text
    • https://ventana-sur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610015b17f75d.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160addac94c5c6---39122823829.pdfIn PDF document text
    • http://www.fsnn.se/wp-content/plugins/formcraft/file-upload/server/content/files/160ac6b7e66027---80383058208.pdfIn PDF document text
    • https://tocgia247.com/wp-content/plugins/super-forms/uploads/php/files/q5bcko1ea71q6v9gecfl6brqis/woxarodogafomofavexuji.pdfIn PDF document text
    • https://rubenoferro.com/userfiles/file/76062765896.pdfIn PDF document text
    • http://joy05.com/_UploadFile/Images/file/96448958776.pdfIn PDF document text
    • https://manualismedicina.hu/fileok/file/27158699856.pdfIn PDF document text
    • https://amartzon.store/wp-content/plugins/super-forms/uploads/php/files/e7433a52a2c5af38be40861ea5977ef9/muvavimawupe.pdfIn PDF document text
    • https://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160cd98a7c04ae---22886590000.pdfIn PDF document text
    • http://traiteur-ribot.fr/userfiles/file/6007458776.pdfIn PDF document text
    • http://xperion.hu/wp-content/plugins/super-forms/uploads/php/files/84a425e16972261dd1394bb63854ed42/fupamizaxonanigubogefu.pdfIn PDF document text
    • http://www.sunaryem.com.tr/wp-content/plugins/super-forms/uploads/php/files/5hs48tpafmpev9vkv48758k8p7/76401793528.pdfIn PDF document text
    • http://funperm.ru/content/file/xasozuvajexubud.pdfIn PDF document text
    • http://www.dadosefatos.net.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c03da0b1a1f---migezewiwuwubewu.pdfIn PDF document text
    • https://bem-sa.com/img/file/ranusurikilupelo.pdfIn PDF document text
    • http://riccaassociati.eu/userfiles/files/ranubewipaxaruwowajilefe.pdfIn PDF document text
    • https://ailani.org/wp-content/plugins/super-forms/uploads/php/files/360971fd17ea758920853076859c4aee/89445958777.pdfIn PDF document text
    • https://mimpishio2bet.com/contents//files/78941544644.pdfIn PDF document text
    • http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/16077cc0609813---wugamonojedojosenofe.pdfIn PDF document text
    • https://t4g.nasscomfoundation.org/wp-content/plugins/super-forms/uploads/php/files/ubbi2276c9bgkd0v5dii99qr72/guramaporafofupoponowila.pdfIn PDF document text
    • http://escalierdurire.fr/ckfinder/userfiles/files/wowopibikimexamejudujopab.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/Om9ozkHLxGw/uplcv?utm_term=what+is+a+half+grand+niecePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000105f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105F1 17132 bytes
SHA-256: 34980f78509f6efb43a735269e32e3e85b9ee53f35cdac59c04ca1c1d5191836
font_01_sfnt_off000132b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x132B2 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00014ac9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14AC9 10628 bytes
SHA-256: c4154a40ee38633b25290c8a8404260ed344e526e658c0b401e1ae68e6a41722

Open this report in the interactive analyzer, or submit your own file for analysis.