Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb1b33d8b7464546…

MALICIOUS

PDF

84.2 KB Created: 2021-06-26 04:48:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 5fccb3195454bebfee7d81578cf3fb68 SHA-1: d6070bbaa9a7b9c5cd5e69f924fbed564b8593fd SHA-256: fb1b33d8b7464546579db3cf56ae230f31dd7e9b06355d83788f8e548f4b9e43
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous links to external websites, many of which are hosted on compromised WordPress installations or disposable domains, suggesting a link farm designed to host malicious payloads or redirect users. The heuristic 'SE_CALLBACK_LURE' indicates the document likely attempts to trick users into calling a phone number, a common tactic in tech-support scams and callback phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9930

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cristiandellavedova.com/wp-content/plugins/super-forms/uploads/php/files/tuuchsqbpj47llllrkcn886j54/zoribaxujusoxupesibo.pdf
    • https://www.urban-quartz.co.uk/wp-content/plugins/super-forms/uploads/php/files/6b61e3178c4ec3e86aea0f35fb470015/wikazotipejugifolane.pdf
    • http://alliusie.com/userfiles/file/jipajifejal.pdf
    • http://raduzhniy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608fb0030e8f5---32915185673.pdf
    • http://beergolfers.com/blog/images/file/19763408900.pdf
    • https://aryaayur.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a74d7b59121---derenizinufufupuzaj.pdf
    • https://flylights.pl/wp-content/plugins/super-forms/uploads/php/files/lav4mq81ofveh472am3i3jsng6/meselolefajikupabafizumo.pdf
    • http://bjoybrands.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a3c430c2c03---pasawepadejowamoposibus.pdf
    • https://cafesca.mx/ckfinder/userfiles/files/95671488725.pdf
    • https://oklasik.com/ckfinder/userfiles/files/73337928254.pdf
    • http://kimyasaldubeller.com/upload/ckfinder/files/82480294759.pdf
    • https://shinyjewellers.com/wp-content/plugins/super-forms/uploads/php/files/r8cnkn9dv9nuccmiueriojqkmn/mopurodimedozi.pdf
    • http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/dd06bfea8a156ac071fceecf68194abe/livegaluzinoxu.pdf
    • http://bindashnews.com/userfiles/file/xixojukixefi.pdf
    • https://balajitutorial.com/admin/userfiles/file/gokusifulolegog.pdf
    • https://winston-woodward.com/wp-content/plugins/super-forms/uploads/php/files/fe42b0f52436812bb659d17e1e026d00/54882014594.pdf
    • http://awkontrakt.pl/ckfinder/userfiles/files/6874765089.pdf
    • http://grgct.com/ckfinder/userfiles/files/20649947406.pdf
    • https://www.hit-education.com/wp-content/plugins/super-forms/uploads/php/files/vti3j6kcjmol3ubhrn896p1r5h/94384452632.pdf
    • https://fieldofgreen.com/wp-content/plugins/super-forms/uploads/php/files/ad27e2a316e0688d38b56a834187670b/vapamepaxaxagat.pdf
    • http://tlxzkj.com/uploads/file/171216079393.pdf
    • http://odesignlab.ru/admin/ckfinder/userfiles/files/vunemaf.pdf
    • https://feedproxy.google.com/~r/skout/mBVl/~3/YTWXjIUwRh0/uplcv?utm_term=autobiography+of+a+yogi+pdf+in+tamil
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ce6f.bin
aa52e09c00fba7e594dc7785d8c3fee9ba5c0a415d6687fca1d17c4beddd0b8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCE6F 16972 bytes
font_01_sfnt_off0000faa0.bin
3411387cfbdec997c96c2f1cf0c4894bf91422224a8b1022abd04d4713181b24		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAA0 10980 bytes
font_02_sfnt_off00011377.bin
11c5a07d087146020572b41e3c25cf6f3fd7b709257038c787216a38c3b0495f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11377 16228 bytes
font_03_sfnt_off0001295e.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1295E 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.