Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f117a98c9bae704…

MALICIOUS

PDF

86.5 KB Created: 2021-10-13 22:02:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: 274d09e3c609a437ba4d3938ad313392 SHA-1: d413b5194a03dc6a973902af24dfc379649a36f4 SHA-256: 8f117a98c9bae70409e57ca036745b3d71b539f1b846996093c78a49fe7ad261
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It functions as a link farm, directing users to multiple external URLs, several of which are hosted on compromised or disposable domains. The presence of PDF_SEO_DISPOSABLE_LINK_FARM heuristic suggests an attempt to obscure the true destination or leverage SEO tactics for distribution. No scripts were extracted, but the overall structure points to a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9947

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://singhaniabrothersltd.com/ckeditor/ckfinder/userfiles/files/xezodavibig.pdf In PDF document text
    • https://mytalk7.com/_UploadFile/Images/file/pazuxog.pdfIn PDF document text
    • https://bistro-8.com/wp-content/plugins/super-forms/uploads/php/files/4503e8c380bfab56dd0ff99adaca79ae/15252101573.pdfIn PDF document text
    • https://www.aaptuk.org/ckfinder/userfiles/files/nutupimemu.pdfIn PDF document text
    • http://siciny.pl/userfiles/file/vevefani.pdfIn PDF document text
    • http://guoyangmoju.com/userfiles/files/dalorujupojuzupozamol.pdfIn PDF document text
    • https://ashleymongolia.mn/uploads/files/zulakibok.pdfIn PDF document text
    • http://jornalespacoaberto.com/app/webroot/datafiles/editor/files/41634307549.pdfIn PDF document text
    • http://mictrogiang.com/userfiles/files/bakanomanab.pdfIn PDF document text
    • http://pxmonastery.org/CKEdit/upload/files/3014887115.pdfIn PDF document text
    • https://www.bluegreenshouseboats.in/wp-content/plugins/formcraft/file-upload/server/content/files/1615cbb706ba5f---zuseguw.pdfIn PDF document text
    • https://minhvuongthuphap.com/upload/ck/files/pagiledusurimuxi.pdfIn PDF document text
    • http://aaaexpressac.com/userfiles/file/midan.pdfIn PDF document text
    • http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/lcbjao5a71ape1rp4t2qt1m5s5/lixifaxevolajuzemunu.pdfIn PDF document text
    • http://sity-luxe.ru/userfiles/file/8250926642.pdfIn PDF document text
    • http://izumrud38.com/ckfinder/userfiles/files/vebonabuxagaravikalazi.pdfIn PDF document text
    • https://efficimm.fr/userfiles/files/103721046.pdfIn PDF document text
    • http://tehpromyar.ru/media/file/15911859514.pdfIn PDF document text
    • https://fivetc.net/uploads/files/85081361930.pdfIn PDF document text
    • https://qualitycountscleaning.com/wp-content/plugins/super-forms/uploads/php/files/8177fbdd36c8e369cc61cba7548bdeb9/zefawarazavimusuvura.pdfIn PDF document text
    • http://zovsh.com/Uploadfiles/files/tojafakovulituja.pdfIn PDF document text
    • http://lso-msm.com/userfiles/file/rabadexojolapefinojalixa.pdfIn PDF document text
    • http://www.sauminandy.com/fckimages/file/xerozizilona.pdfIn PDF document text
    • https://peoplesmodelinternational.com/ckfinder/userfiles/files/rodizut.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Gsjc/~3/cmwvf4RlXg4/uplcv?utm_term=abcd+order+numberPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea28.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA28 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0001023f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1023F 10188 bytes
SHA-256: 7c5c3b47e3d4fb2d2e274776d64401ec1b61f2d66bf620cb11b8603777531baf
font_02_sfnt_off000118ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118FF 19784 bytes
SHA-256: 65aca9386dd8efbed97150b87c6ccd35b9c36e8ce06661bf336cb1ad140e99e8

Open this report in the interactive analyzer, or submit your own file for analysis.