Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa663095dabe809a…

MALICIOUS

PDF

83.7 KB Created: 2021-07-14 04:13:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: f0babbe45f3511df4708f898ec3b61d2 SHA-1: 142db8d6dc63e0a8784410c767cf63f277a8d980 SHA-256: fa663095dabe809a7baa402f64c01265216959fb9d6c072efb04bcd8e03fdc93
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link farm pointing to multiple compromised WordPress sites, a common tactic for distributing malicious payloads. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely instructs the user to open a password-protected archive, a method used to bypass gateway scanning. The ML classifier and ClamAV detection strongly suggest malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cairparavel.ro/app/webroot/files/userfiles/files/relezabew.pdf In PDF document text
    • https://www.jahnigterbraak.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a4f9a71ce54---jupilaxivalovuleziwenuxik.pdfIn PDF document text
    • https://www.abaco-engineering.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607d1cec7bf4b---5856245849.pdfIn PDF document text
    • https://hafa-verein.de/wp-content/plugins/super-forms/uploads/php/files/24c72aaf9cc79475a8d99b34c4313ef3/gowuvewatopitoso.pdfIn PDF document text
    • http://shinies.ru/img/lib/file/mewagewujuzagukura.pdfIn PDF document text
    • https://echipamente-scule.ro/userfiles/file/vanuremaxefebutud.pdfIn PDF document text
    • https://www.parkgest.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1607a712f5fee5---57070976443.pdfIn PDF document text
    • http://s8radziejowice-paszkow.pl/userfiles/file/96489101024.pdfIn PDF document text
    • https://www.chortho.co.uk/wp-content/plugins/super-forms/uploads/php/files/m7rgp9cq0mr2e2n7j6evunti73/gowuzub.pdfIn PDF document text
    • https://zazilha.com.mx/wp-content/plugins/super-forms/uploads/php/files/ff6b9bb957edf30e4ee17a4f2f316863/42796909737.pdfIn PDF document text
    • https://aduanaldelvalle.com/userfiles/file/86535403565.pdfIn PDF document text
    • http://benjamin1908.com/clients/f/f4/f4560e3fe432b95d15e234f900dec36a/File/72208898999.pdfIn PDF document text
    • http://ankaser.com/userfiles/file/58598221846.pdfIn PDF document text
    • https://longhoang.vn/upload/files/debegikovuvuxafabadovaxup.pdfIn PDF document text
    • http://sansboundaries.com/clients/f/fd/fde0d4b6b324343791c5f0705b221951/File/diwave.pdfIn PDF document text
    • https://badoza.net/userfiles/file/16657963458.pdfIn PDF document text
    • http://teechart.com/uploads/images/files/23005151588.pdfIn PDF document text
    • https://bloomeng.com/uploads/zewuvofalurateditima.pdfIn PDF document text
    • https://llsindia.in/FCKeditor/file/widuwajajozuvug.pdfIn PDF document text
    • https://bilbox.es/wp-content/plugins/super-forms/uploads/php/files/04ae5b2d954c5028b467ad2e6d2af8a7/xunudiladifonadudepazawav.pdfIn PDF document text
    • https://www.lashharmony.co.uk/wp-content/plugins/super-forms/uploads/php/files/b9tefc0d2o3skns0gt2boucau9/kikukipinuxadawubug.pdfIn PDF document text
    • https://arizonapoolcontractor.com/wp-content/plugins/formcraft/file-upload/server/content/files/160962d68baa90---63145569389.pdfIn PDF document text
    • https://divorcioconsensual.com.br/wp-content/plugins/super-forms/uploads/php/files/e98e654ff083cbd39a9f234a1202bc12/65667587173.pdfIn PDF document text
    • http://www.findvoters.com/userfiles/file/nixibukofebaraganawa.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=swift+required+init+coderPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e538.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE538 10500 bytes
SHA-256: d58b919afe091c098190178c61616fa1df7e7e868bfcf630fe06535d0b5c42f6
font_01_sfnt_off0000fd0c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD0C 17068 bytes
SHA-256: 4aa204a9a6c86973da9538e274c9d911f9c5bfeb48c899f0ecc3d013ec46d201
font_02_sfnt_off000129a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x129A1 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.