Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ea543112f61b380…

MALICIOUS

PDF

77.7 KB Created: 2021-06-12 17:08:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 28e38d5598e9d2076ad229bb6959b0d4 SHA-1: 1f508f1090594a913ce1b4912b8580d81b6b3a61 SHA-256: 8ea543112f61b380eb2fd0086897c898550bcbfea2da2c911a85278b42608727
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV. It contains numerous links pointing to compromised WordPress sites and disposable hosting, suggesting a link farm designed to redirect users to malicious content. The embedded URLs, such as 'https://nomylo.ru/uplcv?utm_term=miraculous+ladybug+streaming+saison+4', indicate a lure related to popular media, likely to trick users into clicking through to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9274

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/uplcv?utm_term=miraculous+ladybug+streaming+saison+4 PDF link annotation
    • http://www.moteco.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1608d11ee20262---revefipa.pdfIn PDF document text
    • http://beetsom.com/PROGRAM_FCKeditor_UserFiles/file/20795889506099106bcb770.pdfIn PDF document text
    • https://www.infratechgroep.nl/wp-content/plugins/super-forms/uploads/php/files/63170ddd018facdf8895be3981824230/75483364920.pdfIn PDF document text
    • http://ahkjt.com/upfile/file/tosobikolojuvewik.pdfIn PDF document text
    • http://www.etoiles-recrutement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a6d582f2043---15684287749.pdfIn PDF document text
    • https://postscriptproductions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bef3d8d1cb2---37898814694.pdfIn PDF document text
    • http://mgmkt.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160ba62be1ab5e---65223201902.pdfIn PDF document text
    • https://impariant-club.ru/wp-content/plugins/super-forms/uploads/php/files/e688c59d07e206d2961d885662c43113/tojog.pdfIn PDF document text
    • https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160983afd2c9af---nimulutibatatujo.pdfIn PDF document text
    • https://spherule.org/wp-content/plugins/super-forms/uploads/php/files/ebd50746dedea2436669d1d1ca3fa4d7/33460120806.pdfIn PDF document text
    • https://sk-developers.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087e35d44a4b---fudofujafotuwaferovekug.pdfIn PDF document text
    • https://www.hit-education.com/wp-content/plugins/super-forms/uploads/php/files/e58kvs86q40efcme935a0qgsqn/lejonibi.pdfIn PDF document text
    • https://ivfnna.gr/wp-content/plugins/super-forms/uploads/php/files/8cf59817e49bb1a81038013939ed01b0/99474021439.pdfIn PDF document text
    • http://www.assignproject.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607533477a329---josekodijutitewex.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e57c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE57C 5592 bytes
SHA-256: c8a097aad7bf588aacc255dfe7c74e35669db6152fb8cdc60df6ff167ae3bc60
font_01_sfnt_off0000f87c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF87C 12040 bytes
SHA-256: 2a9dba13d17f2f7bd8d2042179f7892a00aff122b2f24b8ba933aafd5fe46a7f
font_02_sfnt_off00011f70.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F70 16204 bytes
SHA-256: e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15

Open this report in the interactive analyzer, or submit your own file for analysis.