Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a8fbc7a622172bd…

MALICIOUS

PDF

82.5 KB Created: 2021-07-06 02:03:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25
MD5: ffd134ce36a8866d9930608b85e7ecaa SHA-1: 78a1dd78560ed80ccd5515fd87d633a7fe3a2f81 SHA-256: 8a8fbc7a622172bdea40b37b24b1f2d94ecaa71faf7ff90d2503c84920106be1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as Pdf.Phishing.Trojan. The file contains a link farm pointing to compromised WordPress uploads and disposable hosting, suggesting an attempt to redirect users to malicious content. The primary attack pattern involves exploiting users through a malicious document, likely as a phishing lure or to download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zanhotel.ro/beficientconsultingFiles/file/danewipadimugix.pdf In PDF document text
    • https://frontiersneurophotonics.org/wp-content/plugins/formcraft/file-upload/server/content/files/1/160afcfde9df37---mabarakave.pdfIn PDF document text
    • http://afghansolar.com/userfiles/file/xetudafimaxogipepedi.pdfIn PDF document text
    • https://braviengenharia.com.br/wp-content/plugins/super-forms/uploads/php/files/u14sss9u822jt9d3jkh6jiks29/54057691772.pdfIn PDF document text
    • https://www.mclarenpress.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d777f864d30---taburiziri.pdfIn PDF document text
    • http://www.ashtralmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/160781207e08a2---92028465860.pdfIn PDF document text
    • http://www.medical-psychology.gr/wp-content/plugins/formcraft/file-upload/server/content/files/1606ffbaf43b60---tutudakalizotisebupi.pdfIn PDF document text
    • http://www.justgiveahand.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607c706176ba9---27810664479.pdfIn PDF document text
    • https://relleno-acidohialuronico.com/wp-content/plugins/super-forms/uploads/php/files/c5750d8115ad51f8a828e820366a7109/60628116145.pdfIn PDF document text
    • http://www.drop-lok.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a8fda00d669---pubimagoxugitixusixukani.pdfIn PDF document text
    • https://vidolamerica.org/wp-content/plugins/super-forms/uploads/php/files/a183977c7ea5551bcd60f68501d1657e/27244332699.pdfIn PDF document text
    • https://afayl.com/userfiles/file/31681237908.pdfIn PDF document text
    • https://maloneslandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a894617c47---45637651503.pdfIn PDF document text
    • https://livingcircles.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1606d01b12edbe---68946772768.pdfIn PDF document text
    • http://acpiindia.com/userfiles/file/813364543.pdfIn PDF document text
    • https://www.revistadefiesta.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075a2c7d66f3---lonawusagopujexugur.pdfIn PDF document text
    • http://tecnoservizi.com/userfiles/files/33743832913.pdfIn PDF document text
    • http://altelaw.com/uploads/image/file/32272946286.pdfIn PDF document text
    • http://www.ncstarim.com.tr/wp-content/plugins/super-forms/uploads/php/files/c1qoeolf74h6ee75igf39ro3s7/kipesow.pdfIn PDF document text
    • http://vipavtoufa.ru/wp-content/plugins/super-forms/uploads/php/files/c389e3d230cc19d932834b2b1ae3a969/muxigerojaziwivoforanun.pdfIn PDF document text
    • https://amiablediamonds.com/wp-content/plugins/super-forms/uploads/php/files/7511e4db4fabf69721a6b63ff97eabe6/77637836619.pdfIn PDF document text
    • https://www.kcequipment.com.au/wp-content/plugins/super-forms/uploads/php/files/7233f76b1de9a53fb945215386bdc28c/nenopimukizepexawi.pdfIn PDF document text
    • http://russkiivopros.com/images/FCKeditor/file/bobolagunozur.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/DOqCt-cVA4I/uplcv?utm_term=wilmer+eye+institute+appointmentsPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dfe5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDFE5 17472 bytes
SHA-256: 62ae4b26c1fc84f45564e270f98d75eaa69a9e8082264526365179e020721188
font_01_sfnt_off00010c7f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C7F 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00012496.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12496 10620 bytes
SHA-256: 4e8b2c195500055c6b31f041be12f67fca6e72b5a44e17ec2cf385d7119338d2

Open this report in the interactive analyzer, or submit your own file for analysis.