Malicious PDF — malware analysis report

Static analysis result for SHA-256 87d0648bdbac54da…

MALICIOUS

PDF

70.6 KB Created: 2021-09-07 12:10:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12
MD5: 30a47e5d1c8907f73030cb40c5dcc59a SHA-1: 3f25b241e5777dceb0b32d576eb3e52a1c19e990 SHA-256: 87d0648bdbac54daaa62a3267db6b6aeb6317076f7a2c30c216ae6c9d873e26b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. Heuristics identified it as a link farm pointing to compromised CMS uploads and disposable hosting, suggesting a phishing or SEO poisoning attack. The embedded URLs, while some are marked benign, are part of a larger pattern of redirecting users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7049

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://africansafaris-spain.com/FCKeditor/editor/filemanager/connectors/php/connector.php?Command=FileUpload&Type=File&CurrentFolder=%2Ffile/situmagabekef.pdf In PDF document text
    • http://constructionone.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609c32833a13c---ruxapovujedikim.pdfIn PDF document text
    • https://swimproject.eu/wp-content/plugins/super-forms/uploads/php/files/c5c9025784f5855799ee98e639355b92/53164032138.pdfIn PDF document text
    • https://www.sblending.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160a5b7d57dd51---59503672793.pdfIn PDF document text
    • http://doo-san.com/userfiles/file/20210508211041.pdfIn PDF document text
    • http://www.maoles.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606fede6eb9af---xafugafal.pdfIn PDF document text
    • https://eyestech.in/wp-content/plugins/super-forms/uploads/php/files/use9n3j91e5p7s905kf6s9956b/tubopitobunajiragepigom.pdfIn PDF document text
    • http://www.tenniscanberra.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160b27b9241be7---57165677515.pdfIn PDF document text
    • https://burkina-businessschool.com/business_school/uploads/file/dafab.pdfIn PDF document text
    • http://gtshotel.it/images/file/vuzovewu.pdfIn PDF document text
    • https://hacunamatata.ru/wp-content/plugins/super-forms/uploads/php/files/94d9bfa219c6a842a434002078754123/wavis.pdfIn PDF document text
    • http://szermgrt.hu/uploads/ckfinder/userfiles/files/vimikafajutakoburilokis.pdfIn PDF document text
    • https://www.hotel-palladium.gr/wp-content/plugins/super-forms/uploads/php/files/7rvhq1h7pp0d81j8265tm2qtgn/84179187438.pdfIn PDF document text
    • http://victorylimo1.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071c7b460cc8---kivebavoviputukudul.pdfIn PDF document text
    • https://givemeit.ru/wp-content/plugins/super-forms/uploads/php/files/0352029bc90566cca67bae152c3d76c7/ruvezunizeribaxifazaxu.pdfIn PDF document text
    • http://zulassungsservice4you.de/bilder/file/61984444515.pdfIn PDF document text
    • https://nsstore.mx/ckeditor/ckfinder/archivossubidos/files/vibezisurefof.pdfIn PDF document text
    • https://cashmeredreams.com/wp-content/plugins/super-forms/uploads/php/files/de857f8d97a8a450617f7c8b03b9003a/89483852005.pdfIn PDF document text
    • https://techielingo.com/fck_uploads/files/tiwadun.pdfIn PDF document text
    • https://www.olympusnorge.no/wp-content/plugins/super-forms/uploads/php/files/vnullqhtuc8dkcmc5i46rtp9e0/91535789017.pdfIn PDF document text
    • http://aberdeeneyes.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160902a267ab26---tewekibawejenagus.pdfIn PDF document text
    • https://www.osteopathe-montpellier-sud.fr/ckfinder/userfiles/files/rukawategifutuwukofubejo.pdfIn PDF document text
    • http://www.molinoag.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ad86bc474ff---tarojomesoxurivuzamuso.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/3vuEKuznOb8/uplcv?utm_term=dioxido+de+silicone+pdfPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bb16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB16 18328 bytes
SHA-256: 45c4ddbfa4eccaec1692e6676a196d6f9a77f18f050608a731cc0c5ce339c925
font_01_sfnt_off0000ea68.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA68 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0001027f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1027F 10356 bytes
SHA-256: e7026d358257e2f85b44e39b3630bf4124029d7b729ad333d5e1fb4fd98464f6

Open this report in the interactive analyzer, or submit your own file for analysis.