Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa256ddb7360975e…

MALICIOUS

PDF

87.8 KB Created: 2021-06-23 12:49:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: fe828f918ceb7542400c75924e16a4cd SHA-1: 7dfe5e1ab49ad753aa30251f2c98214a7a9e03a4 SHA-256: fa256ddb7360975eb2c5b76c2c0475f9db958b92941cddb56615cae499561c24
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing and trojan threat. It functions as a link farm, directing users to multiple compromised CMS upload directories and disposable hosting sites, likely to distribute further malicious content or phish for information. The embedded URLs and the heuristic firings strongly suggest a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stacjaregeneracja.pl/userfiles/file/nilesajalozujixalojaxo.pdf In PDF document text
    • http://www.ausafrica.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160949ba507b94---zakunitoliwegonikagaparaw.pdfIn PDF document text
    • http://www.bridalchapel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f967336e9f---65631126966.pdfIn PDF document text
    • http://alsumiri.net/wp-content/plugins/super-forms/uploads/php/files/35b85747ae5c4a857781f68f98dbcc2e/wipixaxavo.pdfIn PDF document text
    • https://malimbe.africa/wp-content/plugins/super-forms/uploads/php/files/41482122b67862be0ec288d1ec2f5822/15674539593.pdfIn PDF document text
    • https://estigotours.com/wp-content/plugins/super-forms/uploads/php/files/3a99351b5cc726368f65be65a54ff93a/59766694484.pdfIn PDF document text
    • https://akapacha.com/userfiles/file/39244157258.pdfIn PDF document text
    • https://agribusiness.pk/wp-content/plugins/formcraft/file-upload/server/content/files/160b9eaf98b938---50928053077.pdfIn PDF document text
    • https://www.avenueroadadvertising.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c08450da2e8---fubikoxisuzumamal.pdfIn PDF document text
    • http://www.sandzthabapanel.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607bd5ca1f245---nogidonapa.pdfIn PDF document text
    • https://www.infratechgroep.nl/wp-content/plugins/super-forms/uploads/php/files/fccc9e2887344712fc29d3f23b02dbeb/68945412288.pdfIn PDF document text
    • https://agsposure.org/wp-content/plugins/super-forms/uploads/php/files/bc0266159492d3944128426cda651a98/lodonutiwine.pdfIn PDF document text
    • https://islandsvefir.is/wp-content/plugins/super-forms/uploads/php/files/6109qbn0pusobodncd281dr81f/38224228291.pdfIn PDF document text
    • http://saltokisport.com/uploads/files/dowisulamakodix.pdfIn PDF document text
    • http://yuha.be/_files/file/kixofofedanufogixajesoj.pdfIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/ngfLrbzwjls/uplcv?utm_term=discord+animated+profile+picture+without+nitroPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e491.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE491 1528 bytes
SHA-256: ed92cafd901dd1cf1e35098023afc6358b03ff7238836c92b52e0ef4a2243c99
font_01_sfnt_off0000ec59.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC59 5484 bytes
SHA-256: 58a88332e46b38166ae6eeef30e747dae4717a64f8a8a48247426db77789b51f
font_02_sfnt_off0000fee8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFEE8 2316 bytes
SHA-256: 374e1bc11049e2750aa53ff29b446c0e843747e6ee03840a29de6d159c99b266
font_03_sfnt_off000108d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x108D7 15796 bytes
SHA-256: 34ff5ab14fc67792d5cb08247866425bd412615e0057e70e1fc97190302f89fd
font_04_sfnt_off00013780.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13780 17260 bytes
SHA-256: 906e0cc5c31ea40303fb25f561529bee6828c3df156d9706b19f545bb5f78899

Open this report in the interactive analyzer, or submit your own file for analysis.