Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e9f98fd67e5a3b5…

MALICIOUS

PDF

86.8 KB Created: 2021-09-05 21:10:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23
MD5: 5f62b34577dfd29a3a189aac955330c5 SHA-1: 3cfa5a9abb5e7d507f4d700ab4a9a63d33682154 SHA-256: 8e9f98fd67e5a3b5e004d5c79a32f35d0916a4d8e4dbe4517fd236e69767abec
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link

The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating it functions as a link farm. Multiple URLs are embedded, some pointing to compromised WordPress sites, suggesting an attempt to redirect users to malicious content. The presence of numerous links and the 'utm_term' parameter in one URL indicate a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/uplcv?utm_term=in+dreams+lord+of+the+rings+piano+sheet+music+pdf PDF link annotation
    • http://moristas.com/userfiles/files/gunoton.pdfIn PDF document text
    • http://ntouioc.ntou.edu.tw/ckfinder/userfiles/files/xemoxumifomafevizabo.pdfIn PDF document text
    • https://er-cardiff.com/eurostyl/photos/file/jufowuwurelazanof.pdfIn PDF document text
    • http://www.evisiontiendaonline.com/ckfinder/userfiles/files/70802092068.pdfIn PDF document text
    • http://simmsfamilyreunion.com/clients/9/98/98d47f1658d09d39d77ba56043454c9c/File/85438530246.pdfIn PDF document text
    • https://omomediacion.com/wp-content/plugins/super-forms/uploads/php/files/ff0279df88940b2c9df8a2c932751d2c/7793758711.pdfIn PDF document text
    • http://www.kinoimaging.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160aaace31130c---vufuvegizilasisutukokiw.pdfIn PDF document text
    • http://bagandpack.ru/wp-content/plugins/super-forms/uploads/php/files/ddc8a6c07cdf8d34253456f978a7312b/9384457202.pdfIn PDF document text
    • http://pr-dienst.ch/file/69631786286.pdfIn PDF document text
    • http://alrabbancapital.com/file/files/kinekolinesimusuwawa.pdfIn PDF document text
    • https://fjordancv.info/wp-content/plugins/super-forms/uploads/php/files/2d17662131ee1513b164d48d15209b65/purub.pdfIn PDF document text
    • http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/16084310e52065---riwun.pdfIn PDF document text
    • http://strahovka66.ru/userfiles/file/xawowunupotefijosezojeg.pdfIn PDF document text
    • https://www.booster-p.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090e2be634e7---mononupamo.pdfIn PDF document text
    • http://www.idenet.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b1fd1cdbb93---87864652059.pdfIn PDF document text
    • https://brokenspoke.com/wp-content/plugins/super-forms/uploads/php/files/2e8b845f6a2edcacdad83bf38d1bab96/kigozoviroxusibawax.pdfIn PDF document text
    • https://vmkstroi.ru/wp-content/plugins/super-forms/uploads/php/files/1df1076ee46ad5c9e43ac808f7fb7648/55006720877.pdfIn PDF document text
    • https://xn--80aaa1anac6cg.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/c9b4efa7d589b12379ec0dcab21c8c6d/13252655962.pdfIn PDF document text
    • https://mebelpozakazu.ru/wp-content/plugins/super-forms/uploads/php/files/3027a691627c78adc88486e4ed352935/36201743136.pdfIn PDF document text
    • http://fitsiluet.cz/data/file/16203777332.pdfIn PDF document text
    • https://web-sila.ru/wp-content/plugins/super-forms/uploads/php/files/976d55f40e9c5d019e0b35b6e1bc65bf/lofixirupoxonunin.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE5BB 11120 bytes
SHA-256: 0f7a8c259fdd8c98ac57d6ec97244cb0528769e71c08988b334fa36e77bde1e9
font_01_sfnt_off0000ff39.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF39 20464 bytes
SHA-256: b3d498f0596a951c9858864de7ff575e4c066453f70e621d405e55684ed3e993
font_02_sfnt_off00013564.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13564 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.