Malicious PDF — malware analysis report

Static analysis result for SHA-256 faf940f618368471…

MALICIOUS

PDF

79.6 KB Created: 2021-09-01 08:52:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: be6749eefda44b716f2edee3f38dd5b9 SHA-1: 1870e023018a22098b968974fb50d78b727378a9 SHA-256: faf940f6183684717b34422adbd91b6e26275c43a51ee175084fd8e88536cfa5
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains numerous embedded URLs that function as a link farm, directing users to potentially malicious websites. Several heuristics indicate this behavior, including 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM'. The ClamAV detection 'Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0' further supports the malicious nature of the file, suggesting a phishing or trojan distribution intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9289

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hanasushi6.com/uploads/files/98252164657.pdf In PDF document text
    • http://www.como-grup.ro/fisiere/file/vedenaramiveza.pdfIn PDF document text
    • https://people11people.gr/uploads/File/goxalowetegolupajib.pdfIn PDF document text
    • http://penzionklara.cz/userfiles/file/87707692555.pdfIn PDF document text
    • https://weeb.nu/userfiles/file/31706891629.pdfIn PDF document text
    • https://gtsonline.nl/wp-content/plugins/super-forms/uploads/php/files/c13mti8bbpalq1rlo7gda44ouj/80387601367.pdfIn PDF document text
    • http://mcleod-bobbitt.com/clients/64742/File/ratifazafewizuw.pdfIn PDF document text
    • http://alpha-cp.com/userfiles/file/94080852069.pdfIn PDF document text
    • http://unseretochter.com/images/file/78726450570.pdfIn PDF document text
    • https://brunoamaranti.it/wp-content/plugins/super-forms/uploads/php/files/9k24vaes9vviajtnabaj2fqea4/58431448935.pdfIn PDF document text
    • http://atya.eu/files/file/sivugulofomapawivi.pdfIn PDF document text
    • https://www.sixteengrams.com/wp-content/plugins/super-forms/uploads/php/files/lh8mkl9rtta1udud2h3s9kiuqe/61905591740.pdfIn PDF document text
    • http://al-bandak.com/userfiles/file/kekimejabelijozoxijosuniv.pdfIn PDF document text
    • https://anmoul.com/userfiles/file/59881140145.pdfIn PDF document text
    • https://gencshow.com/upload/ckfinder/files/momofulot.pdfIn PDF document text
    • http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/a7093f80fac168ed3d39b0b4783beda5/6321566486.pdfIn PDF document text
    • http://www.anclupnapoli.it/userfiles/file/masixur.pdfIn PDF document text
    • http://conservationenergy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606caa66641c2---4031857858.pdfIn PDF document text
    • https://www.sixteengrams.com/wp-content/plugins/super-forms/uploads/php/files/1189eb9ok56o2s36ctaebqbuil/24437762392.pdfIn PDF document text
    • https://www.hdontheroadnapoli.it/wp-content/plugins/formcraft/file-upload/server/content/files/160c152ab304c5---86891684244.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3vuEKuznOb8/uplcv?utm_term=adjectives+beginning+with+a+to+describe+a+personPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f817.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF817 18620 bytes
SHA-256: 39ed94b8297129d78bd4139cae45e1da45c742ddec0e24f9b517c89e026a409c
font_01_sfnt_off0001274d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1274D 11152 bytes
SHA-256: 59ec8f31351b0879074289b54a1f88700154ca7512982cebcf2720bda67f19b2

Open this report in the interactive analyzer, or submit your own file for analysis.