Malicious PDF — malware analysis report

Static analysis result for SHA-256 8066a60132e6a229…

MALICIOUS

PDF

101.4 KB Created: 2021-06-18 23:18:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 8b76bcf8bb4ff73901aeecb4973de7df SHA-1: ea5f39222e840e01e829d181621c5bffd0e1c4d7 SHA-256: 8066a60132e6a2290be16f8af0a09c0d281f2e8eda0a58be68c6a58abee5b0a6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous links to compromised websites, indicating a link farm designed to redirect users to malicious content. The ML classifier and ClamAV detection strongly suggest malicious intent, likely for phishing or malware distribution. The document body, though heavily obfuscated, appears to be a lure related to 'Uzumaki pdf english'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9876

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.majorisinvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609db9dc2b2c8---58243908448.pdf In PDF document text
    • https://sonntag-immobilien.lu/userfiles/files/watanepobobesunagusuro.pdfIn PDF document text
    • http://www.gcsystem.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16092dffba8a1a---33860954395.pdfIn PDF document text
    • http://driver-jazda.pl/upload/file/82158358833.pdfIn PDF document text
    • https://doucetplasticsurgery.com/ckfinder/userfiles/files/90476993186.pdfIn PDF document text
    • https://vickers-electronics.co.uk/wp-content/plugins/super-forms/uploads/php/files/a2d9ce27fed681e012a34fed2655729e/22077597845.pdfIn PDF document text
    • http://solarhomepage.ch/fckeditor/editor/images/file/16577933698.pdfIn PDF document text
    • https://dixietemporarystorage.com/wp-content/plugins/super-forms/uploads/php/files/8c5347ef4f85d752375e25c36337f849/73309835710.pdfIn PDF document text
    • https://engineeredrepinc.com/wp-content/plugins/super-forms/uploads/php/files/8fbcdd351e57b786e49b53e7f98988bd/nivobagikipajowojasug.pdfIn PDF document text
    • https://na-nule.ru/wp-content/plugins/super-forms/uploads/php/files/as70p03jehb8i6o98laam6m5e3/wezitifik.pdfIn PDF document text
    • http://thehawthornnyc.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e9f34d1cc8---sokoferebegutisutujufu.pdfIn PDF document text
    • http://profisystem.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16072bbff7c6d3---44948427173.pdfIn PDF document text
    • https://christianboudreau.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b88ed2b36b4---riboxababobotevetika.pdfIn PDF document text
    • http://beiwendq.com//data/attachment/file/selizirefanagidebasiwilup.pdfIn PDF document text
    • https://hmv.ir/wp-content/plugins/formcraft/file-upload/server/content/files/160c3e334a5577---64043561337.pdfIn PDF document text
    • http://a-range.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160c08f99ccc9a---pujarepuvefab.pdfIn PDF document text
    • https://hafa-verein.de/wp-content/plugins/super-forms/uploads/php/files/0fdf86b9baa8e9dca7489f65bc2adffc/94181259083.pdfIn PDF document text
    • http://akbmodel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086067e20bb6---tozilovetom.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/DOqCt-cVA4I/uplcv?utm_term=uzumaki+pdf+englishPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_010_off00015a66.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x15A66 18176 bytes
SHA-256: 9a53eb0f5d899206140142024e1329928d04523b9b037af6ea44b3d64dff0b7c
font_00_sfnt_off0000d1bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD1BF 6848 bytes
SHA-256: 75528d6cd72931f1befbe2cddb1fa98c7aa383ee354631b400c8fd3c7ce12e7e
font_01_sfnt_off0000e957.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE957 5464 bytes
SHA-256: 53b08e516ace55bd39ab99c847b83e3735e4fd36a031ca478825557a50e11f46
font_02_sfnt_off0000fbd8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBD8 2656 bytes
SHA-256: dbaab8dcf32bfe64cb008f34eb54f5316f62236e8dffe3de49b44225404383a5
font_03_sfnt_off000106dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106DC 2328 bytes
SHA-256: 864cbe2c6973b44d2b71e19ffbffb2328dcb3759b07ceb43c11d5a372fc4956d
font_04_sfnt_off00011192.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11192 2108 bytes
SHA-256: d117309382da938f7dffedc42f90dd4217b4d540d75629b80669d975ecbc171e
font_05_sfnt_off00011b5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B5D 6640 bytes
SHA-256: 538512be6c526ea957b587fa229624d829dca4873b622d187784a60d2c877fcd
font_06_sfnt_off00012cfb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12CFB 14996 bytes
SHA-256: 46f75d01f701680bfde4ab1b7eed40bf24a7c6d0f94a973371aa665c3d27bdc3
font_08_sfnt_off00017732.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17732 3276 bytes
SHA-256: c12c670e310cd2dd0f4b1ea6ea0d01ef35e1284caa1cfc967b978b02bd897c09

Open this report in the interactive analyzer, or submit your own file for analysis.