Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ee48c16403d1c93…

MALICIOUS

PDF

92.8 KB Created: 2021-07-28 05:45:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12
MD5: c2a122e3e4903a1735b89720d1bae945 SHA-1: 26089e6b8f966cf2d78e996ce7a371de75a4e624 SHA-256: 8ee48c16403d1c93a7977fc937db72a1f8176d04ba7d3e900ea6219411a8670d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of links, many of which point to compromised WordPress sites. These links appear to be part of a link farm designed to redirect users to malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.victorian-manor.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607e7c185af2e---zujikopifilinobotisojozok.pdf In PDF document text
    • http://novaserv.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b968dd58370---gekavefab.pdfIn PDF document text
    • https://www.andyselfstorage.co.uk/wp-content/plugins/super-forms/uploads/php/files/t6q21866qgi5o1uko6vte02efj/pepunosiwabevafeminowud.pdfIn PDF document text
    • http://elencostruzioni.it/userfiles/files/vanafasekifometixivumid.pdfIn PDF document text
    • http://www.mvdisposal.com/wp-content/plugins/formcraft/file-upload/server/content/files/160965399a3e3f---1880374188.pdfIn PDF document text
    • https://estidevelopers.com/wp-content/plugins/super-forms/uploads/php/files/3bfd3e391a0ed0a35b89851824c42d3c/45231072785.pdfIn PDF document text
    • http://chickenwild.com/upload/contents/images/images/22018896346.pdfIn PDF document text
    • https://bauarch.bg/files/53974237598.pdfIn PDF document text
    • https://northstarexecutivesearch.com/wp-content/plugins/super-forms/uploads/php/files/b7b7326735919fa7c90073aadac9d059/dadipedupiza.pdfIn PDF document text
    • https://hylyt.co/wp-content/plugins/super-forms/uploads/php/files/08bcaa0777ebf74c729581c229401890/darejukinotoxizus.pdfIn PDF document text
    • https://provisionsinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ff97d103d6---47420573984.pdfIn PDF document text
    • http://www.awakohchang.com/image/upload/File/0673727485.pdfIn PDF document text
    • http://hoangduy.vn/vn/files/243033223.pdfIn PDF document text
    • http://www.primalegal.eu/wp-content/plugins/super-forms/uploads/php/files/irru4m2evnqtfpi8jc0jg56cg0/degerenozoxuxetaxibemomi.pdfIn PDF document text
    • http://www.sunarozlem.com.tr/wp-content/plugins/super-forms/uploads/php/files/7g7h9c59i8vn11tn8thoo4ue97/dimabezuranesav.pdfIn PDF document text
    • http://yatros.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160b1027fb994c---jivifaxodudefugemela.pdfIn PDF document text
    • https://g-ortho.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160e1792aa14c3---rutevogusigegaguvuxifono.pdfIn PDF document text
    • http://mesotects.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f4e531efdb8---4974835757.pdfIn PDF document text
    • https://evg-prague.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16081c3c21d66b---nabuk.pdfIn PDF document text
    • http://suportti.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607376aa56d13---70228944651.pdfIn PDF document text
    • http://doubler-son-capital.com/photos/files/5913943249.pdfIn PDF document text
    • http://analogsys.com/uploaded/file/1610587112609adcc3ad59d.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/zMnd8XtcwSM/uplcv?utm_term=how+to+control+volume+on+fios+one+remotePDF link annotation
    • http://irodori.kir.jp/files/file/guvamezusibumesa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f009.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF009 17416 bytes
SHA-256: 8352386fb2acb123509680b29a27252155b6c903fa6b2dd6363017b4b181097c
font_01_sfnt_off00011d49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D49 10576 bytes
SHA-256: 414f0ed04de2810708292c52934b1a6df6181f2e7a754916a8cf356ac2fc7901
font_02_sfnt_off00013570.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13570 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off00014d81.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14D81 16704 bytes
SHA-256: f3a20dd5e700ae390a0fe49f1c8ffa79b3fb96a0bd172bb38c6ac14fcf60674b

Open this report in the interactive analyzer, or submit your own file for analysis.