Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c702893572bba84…

MALICIOUS

PDF

80.6 KB Created: 2021-07-26 10:51:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-31
MD5: df93d4b39e965746011f4c60adfa4f91 SHA-1: 3e85ce31a013bb3a37430db1c02f8d90bcfd12fc SHA-256: 8c702893572bba84d0f89d84aa7e7d190a7b2dc6ec04445aef8f130ef0bd4142
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF containing numerous links to external resources, many of which are hosted on compromised WordPress sites. The high number of links and the use of compromised CMS upload storage suggest a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9978

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thanhlamresort.vn/wp-content/plugins/formcraft/file-upload/server/content/files/1608db74001fdb---49343370236.pdf In PDF document text
    • https://ecoinkworld.com/wp-content/plugins/super-forms/uploads/php/files/5767e68baaa2bcdf78268e6df840e702/buvoxijepexovanadi.pdfIn PDF document text
    • https://btsmstlucia.com/atomicsteps/upload/userfiles/file/gagiluxagujetow.pdfIn PDF document text
    • http://hasyo.net/files/file/muvinutizijekaxiwix.pdfIn PDF document text
    • https://saam.vn/images/content/file/9249693276.pdfIn PDF document text
    • https://bamfieldrental.com/userfiles/file/joxodexumajawudobesi.pdfIn PDF document text
    • https://aslimitada.com/userfiles/file/nazibojugono.pdfIn PDF document text
    • http://www.sunarnuricomuisvealisverismerkezi.com/wp-content/plugins/super-forms/uploads/php/files/q3htcu60eeuqe289t80gtlmt42/35392983639.pdfIn PDF document text
    • https://centrosteadycam.it/wp-content/plugins/super-forms/uploads/php/files/eca148a33cb472a386e40f329292189a/jokukafudexebikuxix.pdfIn PDF document text
    • https://postscriptproductions.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c3a3778d5a---lutuvim.pdfIn PDF document text
    • https://emergent-partners.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c720323ded4---kumikukab.pdfIn PDF document text
    • https://nomortiga.com/contents//files/51935875946.pdfIn PDF document text
    • http://alphabodysupplements.com/newerac2c/userfiles/file/8515424548.pdfIn PDF document text
    • http://3xlove.com/uploadfile/file/xofera.pdfIn PDF document text
    • https://agermag.ro/mm/file/wixirit.pdfIn PDF document text
    • https://supermagnum-bg.com/userfiles/file/70490113387.pdfIn PDF document text
    • http://www.adatechotomasyon.net/wp-content/plugins/formcraft/file-upload/server/content/files/160775cdcb0849---kuvukakajezurapone.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609592e9f12c8---wepewikomufiwinivudowifo.pdfIn PDF document text
    • http://conservationenergy.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077b77518596---kixiwuvufoxugajogon.pdfIn PDF document text
    • https://yarsan.ru/wp-content/plugins/super-forms/uploads/php/files/5014cc8060717283a0948d20cf15b7b1/42069762310.pdfIn PDF document text
    • https://stopserv.ru/files/file/vexub.pdfIn PDF document text
    • http://zhuoer.ltd/userfiles/file/88017111861.pdfIn PDF document text
    • https://electroagro.es/pub/files/39881486740.pdfIn PDF document text
    • http://bjoybrands.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ba9c256ab47---44422052691.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/cv9VXjIrmdE/uplcv?utm_term=carolina+rocha+menocal+es+hija+de+ricardo+rochaPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d37f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD37F 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000eb96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB96 10700 bytes
SHA-256: 4c7c1554f9d4c15e0d590e8b01ec653de5064e4ca05124a9da10362aec3f2b72
font_02_sfnt_off000103d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103D3 17776 bytes
SHA-256: e610fcd9d3c8df069bc9290a76bbc6ee301ba62cd5c6145c45001b8656f71eb7

Open this report in the interactive analyzer, or submit your own file for analysis.