Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c8d777317be2226…

MALICIOUS

PDF

88.2 KB Created: 2021-07-13 16:29:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: def372cac225e88cc2fed97e83c5b4b6 SHA-1: e84c59acc336803363e8069cbab428004225ab3e SHA-256: 8c8d777317be2226fc487fce5cfd4fe2efcd385b32bb8f2b650687faf1d0ebf3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous links to compromised websites, many of which host further PDF files. This structure suggests a link farm designed to redirect users to malicious content, likely for phishing or malware distribution. The ClamAV detection and ML classifier strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9822

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://amesmedicalservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b2809852ea3---99648174390.pdf
    • https://www.generalutilities.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609d4c655e2d4---82874133666.pdf
    • http://www.nowsingapore.co.id/wp-content/plugins/formcraft/file-upload/server/content/files/1607e52b0c2e8a---zasotidabirewekaxojilem.pdf
    • http://apcmagon.com/userfiles/xegenamu.pdf
    • https://caravanandre.it/wp-content/plugins/super-forms/uploads/php/files/a709bbbef3167b7e891274a9d187751e/77262180925.pdf
    • https://marksiegeldds.com/wp-content/plugins/super-forms/uploads/php/files/3df947a8007f45a3c6f1f78e5ae567b2/migoratup.pdf
    • https://hcs1000.org/wp-content/plugins/super-forms/uploads/php/files/c89f2be9f16c84f56fbc9021a0141e7e/kofelixupuvo.pdf
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/nf86pm3cklnctqb8j5am63u8t4/66161191431.pdf
    • http://tecresconsolidamentorestauro.it/fck_data/file/18389854656.pdf
    • http://villaturri.com/wp-content/plugins/formcraft/file-upload/server/content/files/160909ea3a6ef0---lewusufixofulajon.pdf
    • http://biomassasia.net/data_ed/userfiles/file/selefemikovejodinulas.pdf
    • https://chefinhogourmet.com/wp-content/plugins/super-forms/uploads/php/files/23e9fecc25b202cf9fdcc48dd7b5de18/silegifetitizojakibekagej.pdf
    • http://www.eflox.net/wp-content/plugins/formcraft/file-upload/server/content/files/160da6eef50375---pobezazuzarak.pdf
    • https://yuktiedu.com/wp-content/plugins/super-forms/uploads/php/files/4071217fce8e582148ab5ad538be03fa/militimog.pdf
    • https://limpjet.com.br/wp-content/plugins/super-forms/uploads/php/files/de9623e0920d6268e66e2ee221af48be/wazifuwuve.pdf
    • http://igabana.com/upfolder/e/files/20210618054419.pdf
    • https://glosunspa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b84fd6c4a8---gigomeregitadas.pdf
    • http://duszek-lasu.pl/userfiles/file/fofitovosejanesujogoba.pdf
    • http://sinara.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c21bb8876a4---54873464903.pdf
    • http://yamamatoen-wanwan.jp/ckfinder/userfiles/files/59507705858.pdf
    • http://www.gradur.ba/wp-content/plugins/formcraft/file-upload/server/content/files/1607f81996a9eb---60649543666.pdf
    • http://erbilsunhotel.com/wp-content/plugins/super-forms/uploads/php/files/b6j555jk2o0r5957fmitkathr0/terag.pdf
    • https://www.alpha-dynamics.gr/wp-content/plugins/formcraft/file-upload/server/content/files/1609647e149438---95107103422.pdf
    • http://ettermanenterprises.com/ckfinder/userfiles/files/dojanowakom.pdf
    • https://greyquotient.com/wp-content/plugins/super-forms/uploads/php/files/727c6b702ebb1020c25968c4e36ad001/mikanepumana.pdf
    • http://www.aceitunasdelguadalhorce.es/ckfinder/userfiles/files/6544531138.pdf
    • http://royalproductsonline.com/userfiles/file/zanetetaxidawu.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=how+to+find+y+with+x+and+slope
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f176.bin
83cedc55313702e00d0cc5b96a5562458988905405dead7e9306d46a4f940c63		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF176 18636 bytes
font_01_sfnt_off000122a8.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122A8 16792 bytes
font_02_sfnt_off00013abf.bin
524a2b8a28f7ffb79a94f450f48afa9129b8a2fd0b909fdeb7dbdbce75ac8dc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13ABF 10788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.