Malicious PDF — malware analysis report

Static analysis result for SHA-256 8019ea8054c1563e…

MALICIOUS

PDF

87.6 KB Created: 2021-07-18 11:18:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: b1c6136a0a6cec48421acdf286b8e3a7 SHA-1: e27528f28cf1f81fd1e9fdc3e078df904f61a105 SHA-256: 8019ea8054c1563e27cdca3fce93c0e7a596413d1c1c0b16517bf8158b485ab9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, with numerous URLs pointing to compromised WordPress sites and other potentially untrusted domains. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' suggests a tactic to manipulate search engine results or direct users to malicious content. No scripts were extracted, and the document body was unreadable binary data.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9972

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vakukh.ru/wp-content/plugins/super-forms/uploads/php/files/f2a31916596016a2bafb020c150eac75/41953015598.pdf In PDF document text
    • https://maugli24.ru/wp-content/plugins/super-forms/uploads/php/files/96f48da54de92a4282d635eefdb52fbf/63415600992.pdfIn PDF document text
    • https://dermo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a9ec0dac28---17866226830.pdfIn PDF document text
    • https://www.digitalsofts.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080fdb181b4c---78318335195.pdfIn PDF document text
    • http://www.orarestauratorisaf.it/wp-content/plugins/formcraft/file-upload/server/content/files/160894e8c2a546---98018834718.pdfIn PDF document text
    • http://abc-tel.ru/data/File/zokiwo.pdfIn PDF document text
    • https://cooperspick.com/files/dofurakozezolojisor.pdfIn PDF document text
    • http://elitaliaweb.it/upload/file/86590784955.pdfIn PDF document text
    • http://www.bridalchapel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cd624f772b0---93058996950.pdfIn PDF document text
    • https://amesmedicalservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078288e56d24---joxesil.pdfIn PDF document text
    • https://bentzendesign.se/wp-content/plugins/formcraft/file-upload/server/content/files/1608448010dfc3---lukazovew.pdfIn PDF document text
    • https://www.sidertest.it/wp-content/plugins/formcraft/file-upload/server/content/files/160bf91afe916f---1554593794.pdfIn PDF document text
    • https://extremetour74.ru/wp-content/plugins/super-forms/uploads/php/files/66f7bf0ee2357a9b6477d022f05ae4ce/kevafovivepomonesusatekor.pdfIn PDF document text
    • https://bleikss.com/userfiles/file/84672229304.pdfIn PDF document text
    • https://amesmedicalservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a9d71632532---57187201049.pdfIn PDF document text
    • https://galedo.cz/www/data/cms_files/files/46252449080.pdfIn PDF document text
    • http://www.risingstars.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1607f600303f34---84942339767.pdfIn PDF document text
    • https://freedomtampons.com/wp-content/plugins/super-forms/uploads/php/files/a67ed89278196c5c6bf1c36390c8da74/19255620593.pdfIn PDF document text
    • http://www.guaitoli.eng.br/wp-content/plugins/formcraft/file-upload/server/content/files/16094c8e434d14---popedebarebiwatajagerek.pdfIn PDF document text
    • http://furkansigorta.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160c8d4b71d855---80697356084.pdfIn PDF document text
    • http://polymer-optix.de/userfiles/file/20228370747.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BkSY9tpko7c/uplcv?utm_term=the+other+side+of+abbey+roadPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea7a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA7A 10516 bytes
SHA-256: b979a96cc51033aacbe4822c9429dbb1dd0a8336c64ea2c43339017e94fd0eb4
font_01_sfnt_off0001029e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1029E 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00011ab0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11AB0 21572 bytes
SHA-256: b61bee3e4ae4887d3f4ff016e9ce019c78be7fa7875de4e52827543e81b3a2ff

Open this report in the interactive analyzer, or submit your own file for analysis.