Malicious PDF — malware analysis report

Static analysis result for SHA-256 8db5d6f7a4796882…

MALICIOUS

PDF

85.9 KB Created: 2021-09-07 22:45:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: 68618a04b94479be3b1cbb7ed03929da SHA-1: 431310285f1a61d29813831e7a4ceed47b692fef SHA-256: 8db5d6f7a47968822539d69753f9f02f452bd13293012fb421c79f2a9b3381f3
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a link farm pointing to compromised WordPress sites, likely intended to trick users into downloading further malicious content. The presence of a 'Password-protected archive handoff' heuristic suggests a multi-stage attack where the user is instructed to obtain a password for an encrypted payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9905

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/uplcv?utm_term=library+genesis+book+pdf PDF link annotation
    • https://aryaayur.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b1a0fbbade7---susure.pdfIn PDF document text
    • http://jsushibrea.com/uploads/files/danozomaditarikiwovuf.pdfIn PDF document text
    • https://loskutova.site/wp-content/plugins/super-forms/uploads/php/files/c4b8aae174ecb09c072367b002b07b23/beruwewesesakebaxotugij.pdfIn PDF document text
    • https://southtours.com/wp-content/plugins/super-forms/uploads/php/files/pml0bivjk94dl8icqk0vj7fbum/32530542780.pdfIn PDF document text
    • https://skiclubraonbaccarat.fr/pdf/xudekagasajokin.pdfIn PDF document text
    • https://ajansnigde.com/resimler/files/8981933290.pdfIn PDF document text
    • http://associacaoguainumbi.org.br/wp/wp-content/plugins/formcraft/file-upload/server/content/files/16070feaab2619---87993932853.pdfIn PDF document text
    • http://hauptlawoffice.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/porojemufidur.pdfIn PDF document text
    • https://www.businesswatchguardingservices.co.uk/wp-content/plugins/super-forms/uploads/php/files/2e5aup91fbebjn75rg5kva36l6/dagovej.pdfIn PDF document text
    • http://kirks-pool.com/wp-content/plugins/formcraft/file-upload/server/content/files/1611ddf7797960---99500901398.pdfIn PDF document text
    • https://medgarlci.com/wp-content/plugins/super-forms/uploads/php/files/3ed1fbb5d308426fa577a7117b5396da/31224259214.pdfIn PDF document text
    • https://www.dyna-tech.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16119f80d6444b---jogulumujakotu.pdfIn PDF document text
    • http://briquettemachinery.com/d/files/19882290200.pdfIn PDF document text
    • http://rogo-rotterdam.nl/files/59924158191.pdfIn PDF document text
    • http://www.idenet.net/wp-content/plugins/formcraft/file-upload/server/content/files/160c7c17fc3731---lojodevewijudegenapipej.pdfIn PDF document text
    • http://savaksangida.com/resimler/files/junofonetowuvakovad.pdfIn PDF document text
    • http://ksnjl.com/userfiles/files/xizubugigupokinot.pdfIn PDF document text
    • http://barcelonasixtytwo.com/userfiles/file/18841913979.pdfIn PDF document text
    • http://www.microsinusectomi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b27a6c4552---82484043354.pdfIn PDF document text
    • http://ipost.mn/ckfinder/userfiles/files/2454933939.pdfIn PDF document text
    • http://naphogacomposite.com/upload/files/pulupuzof.pdfIn PDF document text
    • http://www.louthadventures.ie/wp-content/plugins/formcraft/file-upload/server/content/files/1606cbef208295---85084048264.pdfIn PDF document text
    • http://vasilii-orlov.fun/wp-content/plugins/super-forms/uploads/php/files/e5e2fc6563f940d8e8d39d1c39e2bb44/18441856242.pdfIn PDF document text
    • http://cohn-vossen.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609e471ec3b75---89367321972.pdfIn PDF document text
    • http://romanakladatelstvi.cz/userfiles/file/wupodufukaji.pdfIn PDF document text
    • http://kemenyseprosiklos.hu/upload/file/wudaraluxarunoduvuz.pdfIn PDF document text
    • http://erex.hu/upload/file/wegegulagegezawol.pdfIn PDF document text
    • https://nomortiga.com/contents//files/98592125753.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA60 18016 bytes
SHA-256: bec88348934dfa434d12d1c63da00c5b3a49406934aa845d091f9d774238c53b
font_01_sfnt_off00011913.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11913 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0001312a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1312A 10832 bytes
SHA-256: c35a50d484cec5d8e63e7ede9297f3e1625f3dd8e6e6d02a5a4ee41df8b0fb6c

Open this report in the interactive analyzer, or submit your own file for analysis.