Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc973cb71da2bf28…

MALICIOUS

PDF

70.8 KB Created: 2021-09-28 07:29:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-23
MD5: 020b66894bd8d9cfb5a7299c8112a630 SHA-1: 0a9cffd076813cf1f182597d1d94ee1009ca7b53 SHA-256: fc973cb71da2bf28ec3dc82c526cb0640b44ebf6fec9eabb91e078a941fa204b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains numerous external links, many of which point to compromised websites or disposable hosting, indicating a link farm designed to distribute malicious content or phish users. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9965

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garglob.ru/uplcv?utm_term=modern+combat+5+system+requirements+android PDF link annotation
    • http://isotope3.pm-ural.com/uploads/files/38164377366.pdfIn PDF document text
    • http://sloplast.com/userfiles/files/49399437604.pdfIn PDF document text
    • https://ngonluathan.vn/images/ckeditor/files/bupavebu.pdfIn PDF document text
    • https://perfumes.dropship-tracking.com/userfiles/files/9355494484.pdfIn PDF document text
    • http://dsagco.com/Upload/file/21158933422.pdfIn PDF document text
    • http://nuovartea.eu/userfiles/files/67182714704.pdfIn PDF document text
    • http://antasboru.com/guvennet/resimlerfiles/fotetosumebibonepoka.pdfIn PDF document text
    • http://www.octopus-quatuorvocal.com/ckfinder/userfiles/files/febelikegibilugatamox.pdfIn PDF document text
    • http://www.cenlajobinator.com/siteuploads/editorimg/file/76531586780.pdfIn PDF document text
    • https://eatorhours.org/e-bussiness/fckimages/file/76094863337.pdfIn PDF document text
    • http://phaptangpgvn.net/app/webroot/upload/files/likaditilujeba.pdfIn PDF document text
    • http://datacomsystems.cz/userfiles/file/gumawenanegeripulada.pdfIn PDF document text
    • http://chocolatycakes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614b90e3ce59a---39769882443.pdfIn PDF document text
    • http://hasanmasat.com/ckfinder/userfiles/files/mesaxomepurudenogek.pdfIn PDF document text
    • https://lorenzonimmigrationlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613dd5b1e09f1---ronigazasezorub.pdfIn PDF document text
    • http://abwwilson.com/uploads/files/34691785695.pdfIn PDF document text
    • http://cesarrodarte.com/userfiles/file/xizidamal.pdfIn PDF document text
    • https://studiogreenwich.ru/wp-content/plugins/super-forms/uploads/php/files/df7826b4f2e51ccfacd7bde9418843c3/67806630206.pdfIn PDF document text
    • https://jaunimodienos.lt/wp-content/plugins/super-forms/uploads/php/files/gj87nvhbmlonpr25qltetj951o/kulur.pdfIn PDF document text
    • http://www.allatpatikapecs.hu/images/file/wolowinifewevikefojedu.pdfIn PDF document text
    • https://whitelightdesign.com/wp-content/plugins/super-forms/uploads/php/files/313b005d5f4afa6b91b4609bf8c1ad23/52247130358.pdfIn PDF document text
    • http://gibisch.org/files/files/lotam.pdfIn PDF document text
    • http://hillsclinic.com/fckeditor/editor/filemanager/connectors/php/userfiles/file/rarotupozejiwi.pdfIn PDF document text
    • https://mygamedaysports.com/wp-content/plugins/super-forms/uploads/php/files/6a7e2db138c931c2fc7cef78abe2d71b/mavuta.pdfIn PDF document text
    • http://gesundimjob.at/images/content/files/wudinoloripuzele.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b170.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB170 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000c987.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC987 11112 bytes
SHA-256: 06556afd6f2c52f9a07341c26b0cbb90dbc8825a0c08c0b76293ff914e8ff9d0
font_02_sfnt_off0000e351.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE351 16588 bytes
SHA-256: 49fe31135cee3b426cfed6872152a04b49ae8cdac213226fb84984ae1a3d410f

Open this report in the interactive analyzer, or submit your own file for analysis.