Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f368cc45b7d3df7…

MALICIOUS

PDF

80.4 KB Created: 2021-09-07 10:52:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: 71cf261f8581ad79e6ed3085589dbefc SHA-1: 9172ad4dc34f45f99de79bbed4084db2b387a974 SHA-256: 8f368cc45b7d3df74244bd20c1831fee4560ee4ff1f8e6f61cf63fffcf969fc8
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is detected as a malicious PDF by ClamAV and exhibits characteristics of a link farm, directing users to multiple external websites. The presence of embedded URLs and the heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicate an attempt to distribute malicious content or phish for information. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the overall structure suggests a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier clean score 0.2429

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/uplcv?utm_term=keynote+to+pdf+converter+free PDF link annotation
    • http://vimbark.sk/editor_uploads/files/83734527952.pdfIn PDF document text
    • http://bukharaalpharetta.com/sites/default/files/file/bukisobaxefiroxisoxeven.pdfIn PDF document text
    • https://drainscovers.com/wp-content/plugins/super-forms/uploads/php/files/46f937bd48528953111ee712ad51279d/xobixenofovidegu.pdfIn PDF document text
    • http://hanabi-la.com/uploads/files/78067886442.pdfIn PDF document text
    • http://tiszaladany.hu/upload/file/4703305602.pdfIn PDF document text
    • http://mnogonomerov.ru/uploads/file/59125868069.pdfIn PDF document text
    • http://meskerjager.nl/media/files/didesuzaxuxaxusuxu.pdfIn PDF document text
    • http://maychebiengoduykhuong.com/media/ftp/file/75837837931.pdfIn PDF document text
    • http://kemmurad.com/webroot/img/files/bujegodufajojo.pdfIn PDF document text
    • http://telecycling.info/files/file/jevola.pdfIn PDF document text
    • http://adamslakeband.org/userfiles/file/60707189811.pdfIn PDF document text
    • https://www.rath-catering.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606d18cd5cef9---84107986808.pdfIn PDF document text
    • https://3dreamstudios.com/wp-content/plugins/super-forms/uploads/php/files/1815296950077c8002623634c7c9b4cf/41822088019.pdfIn PDF document text
    • https://jordanadams.com/ckfinder/userfiles/files/jizoxepemefulim.pdfIn PDF document text
    • http://goteneplast.se/files/images/file/11635955672.pdfIn PDF document text
    • https://eurotig.ro/file/5670736254.pdfIn PDF document text
    • https://cottonweb.net/userfiles/file/rutupukuwipojumomivife.pdfIn PDF document text
    • http://thevenetianmask.com/clients/71561/File/49845330211.pdfIn PDF document text
    • http://ngpsusa.com/wp-content/plugins/super-forms/uploads/php/files/5sgeml53mlhh3ub22rna2dk681/bobibozepekovopomodesuvu.pdfIn PDF document text
    • https://puntoagricoltura.it/file/tigizobapaguxekuxifigozaz.pdfIn PDF document text
    • http://www.etoiles-recrutement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aebae7af5ce---pupovija.pdfIn PDF document text
    • https://avphunter.ro/ckfinder/userfiles/files/96179060329.pdfIn PDF document text
    • https://dezsredstvompx.ru/wp-content/plugins/super-forms/uploads/php/files/5cdb78b13d6f45040e1eb80bf9e73559/wovigebowujaju.pdfIn PDF document text
    • http://haiphongcontest.com/images/files/96391485874.pdfIn PDF document text
    • https://trichynext.com/wp-content/plugins/super-forms/uploads/php/files/214ec418a50ceb2227281cbaaa40f098/mujawigilaxesoruvo.pdfIn PDF document text
    • https://borderpak.com/wp-content/plugins/super-forms/uploads/php/files/2357216d8773c252790eb0a99bf3de6a/48733137383.pdfIn PDF document text
    • https://hotel-la-licorne.fr/userfiles/file/25562541905.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4DB 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000fcf2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCF2 10316 bytes
SHA-256: 501983bdbc058de92a5c929400e07ac131b57636f214266f4ac3aa2660ea4c36
font_02_sfnt_off00011455.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11455 17516 bytes
SHA-256: 03a31605689140ff03b32922ad4f76c1bf1002e813874cd894d59279362aa728

Open this report in the interactive analyzer, or submit your own file for analysis.