Malicious PDF — malware analysis report

Static analysis result for SHA-256 8012c4345dd6e78b…

MALICIOUS

PDF

100.0 KB Created: 2021-08-12 05:36:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 24e5f5aa91acffdbe1880654880d5902 SHA-1: f0e94eb82fb9e46423ea3a02b82bddc9738de2f3 SHA-256: 8012c4345dd6e78b9e6190c3ec73e0853bce28af8f9c5606e2c11fcf4271bc0b
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links, many pointing to compromised WordPress uploads and disposable hosting, suggesting a link farm designed to host malicious files. The 'SE_PASSWORD_ARCHIVE_LURE' heuristic indicates the document likely instructs the user to download an archive and provides a password, a common tactic to evade initial security scans. While no scripts were directly extracted, the ML classifier and ClamAV detection strongly suggest malicious intent, likely involving the download and execution of a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9700

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://aulacvn.com/upload/fck/file/85836970368.pdf In PDF document text
    • http://worldprint.su/userfiles/file/rivilibabadozuzudamaxatax.pdfIn PDF document text
    • http://luatsugiadinhviet.com/upload/ck/files/84150656364.pdfIn PDF document text
    • http://www.roosprommenschenckelfoundation.nl/ckfinder/files/files/65589664071.pdfIn PDF document text
    • http://ecbpolska.pl/wp-content/plugins/super-forms/uploads/php/files/5eb55cc5f8ee5cc4b013cec69635eeb0/wakinusujobadejinile.pdfIn PDF document text
    • https://www.advids.io/wp-content/plugins/formcraft/file-upload/server/content/files/1607379401167a---97019672003.pdfIn PDF document text
    • https://bedandbreakfastchia.it/userfiles/file/29816505890.pdfIn PDF document text
    • http://fixmyhelicopter.com/project-new/christianbook/upload_images/file/21337381945.pdfIn PDF document text
    • http://closehorses.com/userfiles/file/gesati.pdfIn PDF document text
    • https://ocw.tw/uploads/files/56054715291.pdfIn PDF document text
    • http://kirks-pool.com/wp-content/plugins/formcraft/file-upload/server/content/files/160728e2219e22---7308908032.pdfIn PDF document text
    • https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/1362d992cd7501048e98498b669ea434/dozikesonexijixikugufasil.pdfIn PDF document text
    • https://gdr.co.il/wp-content/plugins/super-forms/uploads/php/files/53ad4d9b2c89862a96512e063da69cbb/wekavabojizodale.pdfIn PDF document text
    • https://delphin-bau.com/ckfinder/upload/files/rawifomasezixarafesumewu.pdfIn PDF document text
    • https://www.reparaciondebomba.com.ar/wp-content/plugins/super-forms/uploads/php/files/inmdm3p9831bipi1gh7n7bbjp2/lavijizomos.pdfIn PDF document text
    • https://lion-trading.co.uk/wp-content/plugins/super-forms/uploads/php/files/dvaoeqj127tmha7gbj0p6oilv4/30076039991.pdfIn PDF document text
    • http://d4sontario.com/clients/e/ed/ed023a0734c265ca673a92d1d81de675/File/dewavepofelugef.pdfIn PDF document text
    • https://www.sadcmedia.com/wp-content/plugins/super-forms/uploads/php/files/go5c4261f6du0fncahbdi16lpe/11957406905.pdfIn PDF document text
    • https://takiminsahada.com/wp-content/plugins/super-forms/uploads/php/files/k9na61t5u42f56rhi9i9igvspm/57355602766.pdfIn PDF document text
    • http://thietbianninh188.com/uploads/files/zuxabibema.pdfIn PDF document text
    • http://pamat.ro/UserFiles/file/rebanax.pdfIn PDF document text
    • https://www.fecomerciomg.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609b6056da4ac---25844066731.pdfIn PDF document text
    • https://thewaves.net/wp-content/plugins/super-forms/uploads/php/files/p7bkt4bo8cu7rhg1i6n9nnbtdh/51447069375.pdfIn PDF document text
    • https://naveenent.com/administrator/imagetemp/file/fefatijunaxo.pdfIn PDF document text
    • https://godparents4tz.org/home/god/public_html/ckfinder/userfiles/files/2164371102.pdfIn PDF document text
    • https://www.unicodesystems.com/wp-content/plugins/super-forms/uploads/php/files/jf8tsokiddlb1ss1p9id3ot523/57067199950.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/6naE_Nh8_CY/uplcv?utm_term=hack+monedas+infinitas+dream+league+soccer+2018+descargar+archivoPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010053.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10053 11672 bytes
SHA-256: 1de7eda005843f8e0c4a8a4f396ac8d2a17164e41970f6f22a9ac43dafe11f13
font_01_sfnt_off00011bcf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11BCF 17196 bytes
SHA-256: f54711c114feb55bcfc393fe225ab3eff0f01d96f91b347f237943a0198eade1
font_02_sfnt_off000134ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134EF 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off00014d01.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14D01 19216 bytes
SHA-256: ef379eebeac05012f746d9be951f857d930d9057006ec9d58e1d4f23ec971b69

Open this report in the interactive analyzer, or submit your own file for analysis.