Malicious PDF — malware analysis report

Static analysis result for SHA-256 88a98e5ffb9c9cc9…

MALICIOUS

PDF

96.3 KB Created: 2021-08-11 09:29:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: f0d90abe8e50542940a902ae088bad95 SHA-1: 83eb3aded47c223d29123ced18754be24bca014a SHA-256: 88a98e5ffb9c9cc9181419f7384308033e830e48705a6947ce6ac96e34851431
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous links pointing to compromised CMS upload directories and disposable hosting, indicating a phishing or link-farming attack. Although no scripts were explicitly extracted, the PDF structure and heuristic firings strongly suggest it's designed to lure users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bmsorganica.com/userfiles/file/10070571527.pdf In PDF document text
    • http://rgn2u.com/userfiles/files/gowewefaza.pdfIn PDF document text
    • http://instant-image.net/UserFiles/Site/File/96687316417.pdfIn PDF document text
    • http://geerhannutpourreussir.be/docs/upload/files/kazixijazunisuzubufixirus.pdfIn PDF document text
    • http://www.bridalchapel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160988b936fa97---27067510052.pdfIn PDF document text
    • https://skyfireconsulting.com/wp-content/plugins/super-forms/uploads/php/files/ipsq9mjhd0qbhtm6v1abimvrn1/35345466670.pdfIn PDF document text
    • http://maidichike.com/upload/files/navadadufe.pdfIn PDF document text
    • http://studiopetrilli.it/userfiles/files/61978614869.pdfIn PDF document text
    • https://shayangroup.net/wp-content/plugins/super-forms/uploads/php/files/3f97896463a91a3d1ffe29d3fa04b1e5/6007319210.pdfIn PDF document text
    • http://www.theflightfest.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a528b12eb3c---migiwedukomiwugipuninelav.pdfIn PDF document text
    • http://americanpetrochemicals.com/customers/CMS-IMAGES/file/roninigibu.pdfIn PDF document text
    • http://tydafa.com/dafa/uploadfiles/20210715205033.pdfIn PDF document text
    • http://phuwangnam.com/user_file/file/35961127678.pdfIn PDF document text
    • https://tonycustomtailoring.com/nbloom/fckuploads/file/nebozevagujoxurerusunedo.pdfIn PDF document text
    • http://www.hcibatiment.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1607dc7501d338---lomasoziwedaxomatu.pdfIn PDF document text
    • https://atlasautoglass.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b5e232ba75c---82184341317.pdfIn PDF document text
    • http://royalrep.com/userfiles/files/xupojatemikejujusufe.pdfIn PDF document text
    • https://suhrsmad.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160a36430664ca---78553510736.pdfIn PDF document text
    • https://sckstone.com/wp-content/plugins/super-forms/uploads/php/files/37830b3147a0612f2e4c6f524e1465c5/76993669493.pdfIn PDF document text
    • https://ancoraeducacion.com/images/jilezinavigeg.pdfIn PDF document text
    • https://webhostmurah.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c8d20a34d31---50874189470.pdfIn PDF document text
    • https://perfecthospital.net/FCKeditor/file/kuzawinepedavedufurewex.pdfIn PDF document text
    • https://bf-pomosch.ru/wp-content/plugins/super-forms/uploads/php/files/6j3vjj72muufbr18i2qrqlmj83/fivopuzopi.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=cual+es+mi+nahual+mayaPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000113d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113D5 10300 bytes
SHA-256: be19952f91c1780be1152704aa413c74efcf64e995da98a9eeb29cc5d15cd5c7
font_01_sfnt_off00012ac6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12AC6 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000142d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x142D8 18304 bytes
SHA-256: 5aad8b2d9e710674e0f178a3349d9f74fbe0b619da6ff57f2a57685bf2844cac

Open this report in the interactive analyzer, or submit your own file for analysis.