Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc2c2187ce336330…

MALICIOUS

PDF

87.6 KB Created: 2021-07-31 19:26:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: d16aad472551e52fee6969db7dcab9bc SHA-1: 0b2ef89abb10ca196c812e5ca1f0e171eac909d2 SHA-256: fc2c2187ce3363306307f0337e348e25ecc4724efa8fc396ad7ecb5e099f8a95
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, many pointing to compromised WordPress sites or disposable hosting, suggesting it functions as a link farm. These links likely lead to phishing pages or further malware downloads, aligning with a spearphishing attachment attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/uplcv?utm_term=how+to+add+custom+sounds+to+clownfish PDF link annotation
    • http://www.myhhsi.com/wp-content/plugins/super-forms/uploads/php/files/0ef07e7265ba31642039ea87cd086b66/14806896311.pdfIn PDF document text
    • http://biosafety.biz/ckfinder/userfiles/files/zupalurusoxuseviba.pdfIn PDF document text
    • https://anmimar.com/royal/userfiles/file/44706278959.pdfIn PDF document text
    • https://anzmrrn.org/wp-content/plugins/formcraft/file-upload/server/content/files/1609f09ef554fa---petipunorifevoxofobiw.pdfIn PDF document text
    • https://home18.ru/wp-content/plugins/super-forms/uploads/php/files/1e226dedf5f7a2f585a41a17fc43e35a/levok.pdfIn PDF document text
    • http://allasclub.com/campannas/file/50815511122.pdfIn PDF document text
    • https://robinio.de/wp-content/plugins/super-forms/uploads/php/files/oqihnj90l4fq0e4e8d2a8b4u3o/lalogolutudarum.pdfIn PDF document text
    • https://skazkavdom.com/wp-content/plugins/super-forms/uploads/php/files/0c54a31bc9f64b7884d6a33548cf13d8/mafubizugokolugegodulin.pdfIn PDF document text
    • http://www.alex-vasilkov.ru/images/wisdom/file/zarugodukebug.pdfIn PDF document text
    • http://hoondb.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079f58a86986---jonugaru.pdfIn PDF document text
    • https://movesforfree.com/wp-content/plugins/super-forms/uploads/php/files/qqk7j469f3eb8ptm0mvbh8dge5/munekitibeturefijowix.pdfIn PDF document text
    • https://conexus-study-abroad-travel.com/ckfinder/userfiles/file/pidilexu.pdfIn PDF document text
    • https://shared401k.com/wp-content/plugins/super-forms/uploads/php/files/63c81817988e59aefd2f8b7402edeea7/dajakogesesitep.pdfIn PDF document text
    • http://www.telsercom.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b27b9a3f40b---ninexilerisuwidotowa.pdfIn PDF document text
    • http://www.rlktechniek.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16080c9fff011b---56164925505.pdfIn PDF document text
    • http://llux.vn/uploads/files/nalarokuwunax.pdfIn PDF document text
    • http://www.maoles.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b42944e0e62---81076790033.pdfIn PDF document text
    • http://www.jindatunnel.com/up_files/file/99734399331.pdfIn PDF document text
    • http://krevue.cz/UserFiles/File/6987927591.pdfIn PDF document text
    • https://stpetejazz.com/wp-content/plugins/super-forms/uploads/php/files/g6ngcraf554vlmgs80aqviedtt/13192544307.pdfIn PDF document text
    • https://hissekurban.com/resimler/files/suborexirexetonumubiz.pdfIn PDF document text
    • https://gk-termopanel.ru/wp-content/plugins/super-forms/uploads/php/files/9f9d0bf26d187032e376ae996c19c07b/63845202768.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f28e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF28E 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00010aa5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AA5 10684 bytes
SHA-256: 197fbf1699e0dd01e797e47ef6d5da7d16b984c69a0e182d8c27c7bb0c1b939d
font_02_sfnt_off000122ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x122EA 17232 bytes
SHA-256: 1aa3a2b9ae8169d76369a6756d647f948733d57326af74f4b55dd5f223b34674

Open this report in the interactive analyzer, or submit your own file for analysis.