Malicious PDF — malware analysis report

Static analysis result for SHA-256 89fef9b7d787ba29…

MALICIOUS

PDF

183.2 KB Created: 2021-07-19 20:19:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23
MD5: 910c7743a2e6063cf481086f13d59df4 SHA-1: ca9fea07b0d87e6d7a6a2a19004e9d7cd92bc650 SHA-256: 89fef9b7d787ba29532f0a9ea47810922f380fa4d9f9de2b7cba353b45e3f8af
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating it likely serves as a phishing lure or malware distribution vector. It functions as a link farm, with numerous embedded URLs pointing to compromised CMS upload storage and disposable hosting, suggesting an attempt to redirect users to malicious content. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic further supports this, indicating a strategy to obscure the true destination of the links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9631

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://al-farh-iq.com/upload/userfiles/file/5355332083.pdf In PDF document text
    • http://windcampus.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f1a53f05f69---79686816338.pdfIn PDF document text
    • http://www.airportlimofortlauderdale.net/wp-content/plugins/formcraft/file-upload/server/content/files/160771b43571ad---40806909593.pdfIn PDF document text
    • https://aryaayur.com/wp-content/plugins/formcraft/file-upload/server/content/files/16074ca8b27969---lidivufopibuzereto.pdfIn PDF document text
    • http://thankschicken.com/uploads/files/zuwilob.pdfIn PDF document text
    • https://netiko.ge/img/Data/file/ratobep.pdfIn PDF document text
    • https://www.criteriainvest.com.br/wp-content/plugins/super-forms/uploads/php/files/0jki52gctjfq8mp2c25g868qrk/dimogebijiwebesijimidivu.pdfIn PDF document text
    • https://calldidocta.com/wp-content/plugins/super-forms/uploads/php/files/6f333c7a1569f5d47a1961ad163cdedf/61402718009.pdfIn PDF document text
    • https://sammycar.ch/sammy/sites/default/sammyfiles/newsletterfile/85126841635.pdfIn PDF document text
    • https://www.adler-leitishofen.de/wp-content/plugins/formcraft/file-upload/server/content/files/16091dae08329c---zixulunewur.pdfIn PDF document text
    • https://digireg.dk/upload/38593551878.pdfIn PDF document text
    • http://studiodrago.eu/userfiles/files/80002388470.pdfIn PDF document text
    • https://pjkconstruction.ca/images/file/33880230504.pdfIn PDF document text
    • http://studiocariola.com/userfiles/files/pajosisimewafojaterukebu.pdfIn PDF document text
    • https://pbchistoryonline.org/uploads/file/bixuwivuveki.pdfIn PDF document text
    • http://viajesalaos.com/webroot/img/files/dugizuxidulokalujikos.pdfIn PDF document text
    • http://garderoba.sk/images/_file/91218991101.pdfIn PDF document text
    • http://ecohort.com/userfiles/files/jidibufegamesanuwaxejiw.pdfIn PDF document text
    • https://forkidsvietnam.vn/wp-content/plugins/super-forms/uploads/php/files/fu8pvdlmp1ktf9i1fl04bdjm62/nuzevuloti.pdfIn PDF document text
    • https://chupwo.com/editor_upload/file/kadibixar.pdfIn PDF document text
    • http://lacasedescaraibes.fr/file/37102331495.pdfIn PDF document text
    • https://www.hospedeagora.com.br/wp-content/plugins/super-forms/uploads/php/files/42j57tcmss2713i9bf640277vt/92410048413.pdfIn PDF document text
    • https://otdelkamos.ru/wp-content/plugins/super-forms/uploads/php/files/3049bb6947c559930fbddf638ec0c1fc/tiladejixedosololuposutip.pdfIn PDF document text
    • https://dongytueduc.com/wp-content/plugins/super-forms/uploads/php/files/1rvcnhe6r73jsh8s6gsvhf7msp/57758958222.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BvfzZFkJO3s/uplcv?utm_term=this+is+a+possessive+adjectivePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000244d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x244D2 16556 bytes
SHA-256: c3c7c3fb9b8e5299c73166f12ff1af282ecece9febe3a0b816cdd77274e51330
font_01_sfnt_off00025bf2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25BF2 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00027409.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27409 10520 bytes
SHA-256: c58d9f348e654b2ead1f376f1e1fd0ea90c208e722db85de5410b77f2a8a2966
font_03_sfnt_off00028c1f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28C1F 26624 bytes
SHA-256: afd1d10cbce4f49834fb06a800e539699babf474d927ab7a9beac5e3153d17d4

Open this report in the interactive analyzer, or submit your own file for analysis.