Malicious PDF — malware analysis report

Static analysis result for SHA-256 12c8a882cbce95c8…

MALICIOUS

PDF

94.8 KB Created: 2021-08-07 20:50:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: 0c4e05fcbc92e41a7860433eedcdbe50 SHA-1: 4b94502f538b772a92111537a5b4c442b19ffcbb SHA-256: 12c8a882cbce95c81dff39d1e3267be6ebe1f4848764b6f5fe1272541ffe50f3
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF containing embedded JavaScript, which is a common technique for executing malicious code. It also features a link farm pointing to numerous compromised WordPress sites, likely serving as a distribution point for malware or phishing content. The ClamAV detection and ML classifier strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9907

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oniceh.ru/uplcv?utm_term=digital+photography+a+basic+manual+henry+horenstein+pdf+free PDF link annotation
    • http://www.thelawchamber.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aaaeb31b719---poriturufaruvapikepo.pdfIn PDF document text
    • http://ruihuitax.com/files/file/fobakamenovulaw.pdfIn PDF document text
    • https://canadianrelocation.net/wp-content/plugins/formcraft/file-upload/server/content/files/16075f0f09d435---35196736767.pdfIn PDF document text
    • http://hnkingdee.cn/Files/file/202173184751.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084c779e40f7---45741203632.pdfIn PDF document text
    • https://fmpride.com/wp-content/plugins/super-forms/uploads/php/files/9d2e2f44e28112c4e0a242e4084a39cb/94865055910.pdfIn PDF document text
    • http://gardensyellowcab.com/admin/images/file/mowibunelox.pdfIn PDF document text
    • http://www.peretprod.ro/content-images/file/44430185101.pdfIn PDF document text
    • http://securitydirect.it/wp-content/plugins/super-forms/uploads/php/files/c55dafd319482ca01a8432a360a60802/towubodiben.pdfIn PDF document text
    • http://garystrike.com/clients/3/30/301ae0ed988f9237e4cb8f8c41f6cb36/File/zadokedifazokojofi.pdfIn PDF document text
    • http://quimis.org/js/ckfinder/userfiles/files/selufuligo.pdfIn PDF document text
    • http://mygotour.com/FileData/ckfinder/files/20210708_6705147156B9119F.pdfIn PDF document text
    • http://tienhasteel.com/app/webroot/upload/files/fesogosal.pdfIn PDF document text
    • https://szallas-karpatalja.net/upload/67868173509.pdfIn PDF document text
    • http://www.luminicaambiental.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b98ae6e82cc---37050425162.pdfIn PDF document text
    • http://baanpowertrain.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608782fa4e614---sukipogepel.pdfIn PDF document text
    • http://bilcafe.it/userfiles/file/11563551087.pdfIn PDF document text
    • http://k3projekt.pl/uploads/userfiles/files/45798792718.pdfIn PDF document text
    • https://amesmedicalservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072f692493c7---kavajekuz.pdfIn PDF document text
    • http://londonjip.com/userData/board/file/30883754453.pdfIn PDF document text
    • http://espacioschillout.es/images/admin/file/27201446869.pdfIn PDF document text
    • http://springswellness.net/wp-content/plugins/formcraft/file-upload/server/content/files/160a5b9648251a---48431447124.pdfIn PDF document text
    • https://qualitycountscleaning.com/wp-content/plugins/super-forms/uploads/php/files/76390bc82acb30f7a678f9ded3529abb/79158522678.pdfIn PDF document text
    • http://solarissoft.com/img/userfiles/files/3909294499.pdfIn PDF document text
    • https://lentes123.com/aym_image/files/kazomurowerajoben.pdfIn PDF document text
    • http://vmkmsz.hu/userfiles/file/49122505150.pdfIn PDF document text
    • http://kioskcondoweb.wpengine.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f76d2c435a---62132447180.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f327.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF327 11424 bytes
SHA-256: 463aa96f2385bf854fbd5f3c1fbb7afaf28a20fdc9061f8699cbdf6952e4dba5
font_01_sfnt_off00010d91.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D91 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000125a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125A2 16084 bytes
SHA-256: a79c9caf7d9fe7d7e6557dd08284a48a0650ee9668136fadcfdab94fba17ddb2
font_03_sfnt_off00013ad2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13AD2 18236 bytes
SHA-256: 4b5c29d5d48c4cc8525393aa1980d49c25dc4a58c595b9f68a15c10a9c66a592

Open this report in the interactive analyzer, or submit your own file for analysis.