Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c91be9504ca7a3e…

MALICIOUS

PDF

102.7 KB Created: 2021-07-03 02:27:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 3938f0cde6c40bfc53070c749c226d6c SHA-1: 77b38573fc6a025f70661e7efc0c99c494d6711b SHA-256: 8c91be9504ca7a3ef00f0015dfd7371b6cb87ad6020b82d92784ab572a4d5f4e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as Pdf.Phishing.Trojan. The numerous embedded URLs point to compromised CMS uploads and disposable hosting, suggesting a link farm designed to redirect users to malicious sites. The file's purpose appears to be facilitating phishing or malware distribution by leveraging these external links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9309

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oniceh.ru/uplcv?utm_term=intent+meaning+in+english
    • http://stoewebdesign.no/userfiles/file/nevivokamidosisulokufo.pdf
    • http://3handseg.com/wp-content/plugins/formcraft/file-upload/server/content/files/160743f3f0dd9a---51191998810.pdf
    • https://arerp.kr/data/file///84187268887.pdf
    • https://hirurgija.me//files/tupasimavaborajajalesutix.pdf
    • https://www.traveltimevipp.com/wp-content/plugins/super-forms/uploads/php/files/21f61203d9a14f2e7b2d703e830af4a1/runododapujavinusig.pdf
    • http://www.iycadana.org/wp-content/plugins/super-forms/uploads/php/files/28shpvfk54eq6q66q9sv3875n0/judetelegebubezibelifiva.pdf
    • http://lalitas-thaimassage-spa.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607762165eb9b---38011203647.pdf
    • http://mauchlineware.com/html/chapelstreet/web/userfiles/files/54774394521.pdf
    • https://abofahed.com/userfiles/file/dozosupizivodifogu.pdf
    • http://amwordpress.org/wp-content/plugins/formcraft/file-upload/server/content/files/160aaec0c39621---pilisibozijipapox.pdf
    • http://evabody.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1608e77174f603---43786076541.pdf
    • https://borderpak.com/wp-content/plugins/super-forms/uploads/php/files/6a2f1a7a25be9e22d526afbde7447d49/31228749239.pdf
    • http://fincasotilloviejo.es/files/sotillo/_repo/file/59706755634.pdf
    • https://fietenhaardenenkachels.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607bc7a87fdca---81475391560.pdf
    • http://cambresisemploi.fr/ckfinder/userfiles/files/bemomaluzi.pdf
    • https://cortopolis.ar/userfiles/file/gubozetilisubopusu.pdf
    • https://lakecountyoralsurgery.com/wp-content/plugins/formcraft/file-upload/server/content/files/160884a82c26f0---kajerojijufurawikud.pdf
    • http://dailyliving.nl/ckfinder/userfiles/files/senekugejigedomogopefeti.pdf
    • https://www.duffylighting.com/wp-content/plugins/super-forms/uploads/php/files/bcd6ec6212e6818df96e7512ba3f93cf/17406182907.pdf
    • http://for-rent-antwerp.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071a78267976---46121447338.pdf
    • https://sidexsideaudio.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f2ff56712b---wonojuratubito.pdf
    • https://estidevelopers.com/wp-content/plugins/super-forms/uploads/php/files/8e02d618e160e481c9e2a73e600a6e9a/rolupadupimomu.pdf
    • http://csc025.com/userfiles/file/20210702200230_rowim1.pdf
    • https://krimgranit.ru/wp-content/plugins/super-forms/uploads/php/files/bd0e40a29c302c6c7663cc16b3a16210/ketilomigedutudigaboroneb.pdf
    • https://brusroom.com/wp-content/plugins/super-forms/uploads/php/files/f3d320bb13e3bf702105f83e91260559/danukaganuxalevumigudo.pdf
    • http://barrybusiness-crm.com/ressource/devis-photo/files/rujuzin.pdf
    • http://tksvolga.ru/userfiles/file/89975160768.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000ed6f.bin
6ef58775b8aaf2aee8305dcdc96e04a5ca32f16c3acf821fcad777cea52cb5fc		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xED6F 20736 bytes
font_01_sfnt_off000111a7.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x111A7 16792 bytes
font_02_sfnt_off000129b9.bin
50241ac55ca7265ff5363d44f957a6a6be1576fd6784ac68d16b173d42c898a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129B9 25428 bytes
font_03_sfnt_off000167d0.bin
8ac3cf12aac81a8fe9c3f9f46055fd342b78720f79b9f6655f7c3a7657a534ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x167D0 10284 bytes
font_04_sfnt_off00017eb0.bin
a8161c2f5ba9235eb51b4fcc43b6bb219725019365cb8d38f9ec25dfe5ce54ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17EB0 3464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.