Malicious PDF — malware analysis report

Static analysis result for SHA-256 8195209d6e9a85c9…

MALICIOUS

PDF

82.7 KB Created: 2021-06-29 14:03:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05
MD5: 168e0cf14d6704f498b6cc0cef2c77d1 SHA-1: e5062d592f1222c57d14e2224c52d05538140c97 SHA-256: 8195209d6e9a85c93bb48afb8fcf6b039b18ba7eaea795f3d525e465dbf8fde1
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is identified as malicious by ClamAV and a machine learning classifier, exhibiting characteristics of a phishing and malware distribution lure. The heuristic 'SE_BROWSER_INSTALL_LURE' indicates the document prompts the user to install a browser extension or update, a common social engineering tactic. The embedded URLs, such as https://laborke.ru/uplcv, likely serve as download or redirection points for malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9928

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/uplcv?utm_term=wish+first+order+discount+code PDF link annotation
    • http://lovesushiscv.com/uploads/files/bizazetopoxofotobo.pdfIn PDF document text
    • https://www.baptistenhardenberg.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16072b00114812---viwan.pdfIn PDF document text
    • https://expungemyrecordnj.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090d86a5c74a---mudodojefafelobipavaroz.pdfIn PDF document text
    • http://engroupe.ca/aym_image/files/wiwareviwofukenewemexi.pdfIn PDF document text
    • http://www.marcelasemper.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a52841da6d---fowogumagupunowiraxiwul.pdfIn PDF document text
    • https://cspdental.com/wp-content/plugins/super-forms/uploads/php/files/f885716166603a17925832069fb4f393/safidoxedonenunebi.pdfIn PDF document text
    • http://abogarestudio.com/userfiles/file/65775459931.pdfIn PDF document text
    • http://www.radioemka.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609ed3da28607---8053194502.pdfIn PDF document text
    • http://vasvaripalmuzeum.hu/upload/file/36411401228.pdfIn PDF document text
    • http://lab4050.com/upload/editor/file/18881841397.pdfIn PDF document text
    • http://tamilannuaire.com/var/www/vhosts/vps296430.ovh.net/tamilannuaire.com/images/file/govopolejirawusoze.pdfIn PDF document text
    • http://www.ebsjosepirosamaria.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bdac9eedaaf---fegewabinetosubojivur.pdfIn PDF document text
    • http://bougerpourstarlight.org/clients/c/c6/c668404594a1c08d975ab50c7bec58f6/File/44052847151.pdfIn PDF document text
    • http://esejsc.com/upload/files/8044997710.pdfIn PDF document text
    • http://nhandieurangmuoi.com/ckfinder/userfiles/files/34965304920.pdfIn PDF document text
    • https://regenerativetherapyforpain.com/wp-content/plugins/super-forms/uploads/php/files/d4de668b089444a548d4150e875c5bc4/91446303379.pdfIn PDF document text
    • http://endustriyelkiralama.com/wp-content/plugins/super-forms/uploads/php/files/9236l7hlh1mmchhij0ucug6rnc/fowaxiridumubonosaz.pdfIn PDF document text
    • http://www.trimbleexpress.sk/wp-content/plugins/formcraft/file-upload/server/content/files/160926dfd3bdce---vaxifafuwebajoruwejikuva.pdfIn PDF document text
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/rtbnem49lh7tkijt3ke16dtt31/tepisavutonadow.pdfIn PDF document text
    • http://www.miamiairportlimo.net/wp-content/plugins/formcraft/file-upload/server/content/files/160bd023f0eff8---kuvigevaganuwesaf.pdfIn PDF document text
    • http://mini-garden.ru/userfiles/file/40202836798.pdfIn PDF document text
    • https://www.straightmyteeth.eu/wp-content/plugins/super-forms/uploads/php/files/a12b7af3fc5b2440115e2c1ef3bc63f6/97674092905.pdfIn PDF document text
    • http://www.medicalalliedtraining.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b74ff50d869---fugunupenibenipujuzolaw.pdfIn PDF document text
    • https://alatheir.com/atheirwsfiles/file/pobija.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cb75.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCB75 10456 bytes
SHA-256: ebad0449fb734dde71c2e124b520ed911333233cf666cae8ddb052137dc85aaf
font_01_sfnt_off0000e32d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE32D 16144 bytes
SHA-256: fcca37035df06e555c2991ff65faa0e8497ca6423bee408ebc46b3aef925b516
font_02_sfnt_off0000f8a8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8A8 17204 bytes
SHA-256: a05d66a82e80ede00ad04d612bea6451977c6e52975d201c06af4a0a14339063
font_03_sfnt_off00012512.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12512 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.