Malicious PDF — malware analysis report

Static analysis result for SHA-256 892f10b61e01523f…

MALICIOUS

PDF

94.3 KB Created: 2021-07-08 10:11:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 7bb29b299b78c829db28bb54031fe228 SHA-1: 6347cab56763b8fb8b2180ab267685c713538cf9 SHA-256: 892f10b61e01523f298cd85d17a7d7fef73eb948d60ee0a7e1fbc456bad3d511
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links to external websites, many hosted on compromised WordPress installations, suggesting it functions as a link farm. The primary purpose appears to be directing users to potentially malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9820

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/uplcv?utm_term=head+congestion+meaning PDF link annotation
    • http://bestforfishing.com/wp-content/plugins/super-forms/uploads/php/files/6062e7451c2db006c8ce26330e68f3a2/putote.pdfIn PDF document text
    • http://www.tekkoo.net/images/library/File/kopuz.pdfIn PDF document text
    • http://www.fotografoeventimilano.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087fe8d5dd5f---taxogefuxitixibun.pdfIn PDF document text
    • https://regalcabs.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16081137a89783---4279594544.pdfIn PDF document text
    • http://www.advancedevents.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607681d06ac68---5041655153.pdfIn PDF document text
    • https://betonwerkendejonge.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160801047c77fc---7033915592.pdfIn PDF document text
    • https://worldkelo.com/wp-content/plugins/super-forms/uploads/php/files/04537f6c51020fc2bea5222ab6c65226/99273797464.pdfIn PDF document text
    • http://language-coach.pl/uploads/files/boralasujenidu.pdfIn PDF document text
    • https://xn-----6kcabagcgfjsxjciriy6alkh6a7aqk.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/2872e13804669e4ec70107461acf303c/sozefotufikagapidodo.pdfIn PDF document text
    • http://legendtec-eg.com/wp-content/plugins/super-forms/uploads/php/files/mluf4fv7p14109vi7tb4p5vqh5/gomodisibarosak.pdfIn PDF document text
    • http://www.ncstarim.com.tr/wp-content/plugins/super-forms/uploads/php/files/r3vsgmsluqkoputnme7i9dcmt7/wopurugizovixam.pdfIn PDF document text
    • http://ipvoicenj.com/wp-content/plugins/formcraft/file-upload/server/content/files/16076f7936f302---66786374154.pdfIn PDF document text
    • http://cloverpark1960.com/clients/1/17/17c242f0968dc4bce059666b43fbd075/File/pazeputebifejek.pdfIn PDF document text
    • https://autosaloncenter.com/uploads/file/xarijowaripozefov.pdfIn PDF document text
    • http://meble-tk.pl/userfiles/file/donevamafod.pdfIn PDF document text
    • https://www.femregenx.co.za/wp-content/plugins/super-forms/uploads/php/files/88t9l46bv7emcipgdqdbscr7ft/xagijurotilito.pdfIn PDF document text
    • http://fortlauderdalelimorental.net/wp-content/plugins/formcraft/file-upload/server/content/files/16094ea03badfc---66874236517.pdfIn PDF document text
    • https://mymovingestimate.com/wp-content/plugins/super-forms/uploads/php/files/8b8cb0947c7654ed14041e005c3f4c11/90985272083.pdfIn PDF document text
    • http://staractivecollection.com/resimler/site/files/18977362325.pdfIn PDF document text
    • http://blessingsngo.in/userfiles/files/16893743899.pdfIn PDF document text
    • http://gotween.com/userfiles/file///32509925898.pdfIn PDF document text
    • http://www.sunarnuricomuisvealisverismerkezi.com/wp-content/plugins/super-forms/uploads/php/files/g4pcbd9ueo2j9fevh4drhrca53/66020349135.pdfIn PDF document text
    • https://lea-inc.com/wp-content/plugins/super-forms/uploads/php/files/28de261ded56752d3a390fa469d5ee1a/38912747330.pdfIn PDF document text
    • http://simonide.org/userfiles/file/91293599620.pdfIn PDF document text
    • https://k9-warrior.com/wp-content/plugins/super-forms/uploads/php/files/8efbf18k86dleg0dk32f6do7im/bumelisu.pdfIn PDF document text
    • https://stagerightstaging.com/wp-content/plugins/super-forms/uploads/php/files/b684b9c9cf241a99ca5bbfb158b713e7/bupoduf.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010d04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D04 10560 bytes
SHA-256: b71c8e4c9f4f061718b9dc63cd0f49a99235141e1b967eb2d42cfb21cc221530
font_01_sfnt_off000124cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124CD 18468 bytes
SHA-256: c0feff165169fac211ad2804642fed7f546206372a9ed2cb328d5b1ad3fefd3c
font_02_sfnt_off000153d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x153D5 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.