Malicious PDF — malware analysis report

Static analysis result for SHA-256 64f8aadd1e46bb88…

MALICIOUS

PDF

80.5 KB Created: 2021-06-30 06:08:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25
MD5: 944d7792e0eec0661fdaf768545f8a0a SHA-1: a3f6e2393407539078e5023e1a3ee1e13195e44c SHA-256: 64f8aadd1e46bb8892d7a1af016f82cec7e07eb197a93d748f54017a46f19559
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, with numerous embedded URLs pointing to various domains, many of which appear to be disposable or compromised. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' specifically flags this behavior, suggesting the document is designed to lure users to external sites, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9833

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sip7.online/wp-content/plugins/super-forms/uploads/php/files/5cdaafd681daaa996289c34d82a837a3/nulimewukuxeginix.pdf In PDF document text
    • https://cruiseship.cruises/wp-content/plugins/super-forms/uploads/php/files/5ddla51hf90dvimbsbtlesak2v/39634764999.pdfIn PDF document text
    • http://tsg-edinstvo.ru/userfiles/file/kiforifugabada.pdfIn PDF document text
    • http://crmrealty360degree.in/userfiles/file/88734122782.pdfIn PDF document text
    • http://www.zopfitravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160db8b303035e---lolisamelibulimajaxa.pdfIn PDF document text
    • http://stitesattorney.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/tebajoxepivef.pdfIn PDF document text
    • https://40parables.com/wp-content/plugins/super-forms/uploads/php/files/df247fa1ecaf2843989216c85a956b46/zaxazuvazuxadimotivodumo.pdfIn PDF document text
    • https://www.heracles-hotel.eu/wp-content/plugins/super-forms/uploads/php/files/dvgdivobgl5na27p9hgc9srv2l/ligepidaxi.pdfIn PDF document text
    • http://anhuifan.com/upload_fck/file/2021-5-14/20210514174454156497.pdfIn PDF document text
    • https://rozgarnetwork.com/ckfinder/userfiles/files/49030278799.pdfIn PDF document text
    • https://am-system.eu/ckfinder/userfiles/files/kuralunumipomatujuba.pdfIn PDF document text
    • https://otelnamore.com/wp-content/plugins/super-forms/uploads/php/files/7235d47bbca4ee50d08d94a228f9c5d1/sutiludob.pdfIn PDF document text
    • https://alphaveneers.co.uk/wp-content/plugins/super-forms/uploads/php/files/b1be5d054ebbcc4ef622474d2f4f14ae/tidopipibogalepevizo.pdfIn PDF document text
    • http://xn--e1aazeoc7d.xn--p1ai/images/shared/file/wekep.pdfIn PDF document text
    • https://www.popcaffe.it/wp-content/plugins/super-forms/uploads/php/files/abfd533f09cdc7885afb6588e324db8c/50409455746.pdfIn PDF document text
    • http://lifestyleufa.ru/wp-content/plugins/super-forms/uploads/php/files/2fae6b1deae7337eb0651685b1c23464/49129107138.pdfIn PDF document text
    • https://alsharqcc.com/userfiles/files/90201843165.pdfIn PDF document text
    • http://leap-egypt.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d933330017---56512268519.pdfIn PDF document text
    • http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/add5451b885fb9ef952402773bf9d013/92860703256.pdfIn PDF document text
    • http://wowbond.com/upload/Fckeditor/file/23934681505.pdfIn PDF document text
    • http://pileshoppen.dk/userfiles/file/72975792749.pdfIn PDF document text
    • http://maihome.hu/admin1/file/mudolagozafaru.pdfIn PDF document text
    • https://www.saenger-ohg.de/wp-content/plugins/formcraft/file-upload/server/content/files/160b18b6c0d6a9---pebapogukoxekuxajusubavop.pdfIn PDF document text
    • http://sieuthihatgiong.vn/webroot/img/files/betuvodudofufisivavuxema.pdfIn PDF document text
    • http://auburn-properties.com/userfiles/files/79584013903.pdfIn PDF document text
    • http://challendor.com/fckeditor/upload/file/medijavub.pdfIn PDF document text
    • https://joefairless.com/wp-content/plugins/super-forms/uploads/php/files/95754bf2dd7e2da4645adcf8e373957d/91060621724.pdfIn PDF document text
    • https://expeditions-travel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16092d4eb34a9a---gefiduwogiwulateb.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/ngfLrbzwjls/uplcv?utm_term=cable+news+channel+ratingsPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d687.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD687 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000ee99.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE99 17492 bytes
SHA-256: 38fdb7da9edfe96d060f41b99dc43e7a81355bad744b1e4bcf983bd537bbfc33
font_02_sfnt_off00011c1e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C1E 10648 bytes
SHA-256: d58250f3281c348fa6e7f14b0b3b51fa9d4810a3c4c15de8b44905ac36871b75

Open this report in the interactive analyzer, or submit your own file for analysis.