Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f3fcb53c2a83aa6…

MALICIOUS

PDF

82.0 KB Created: 2021-09-12 21:17:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14
MD5: bcee71f3886a15f2a5c168850e1a0dbb SHA-1: 9853a033fce96684bcef7bdfe8892717abd5beb0 SHA-256: 8f3fcb53c2a83aa610a60c3dbdd241ba53d0eadbd40e33705506e85fdf0b38bc
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. Heuristics indicate the presence of a link farm pointing to multiple domains, including compromised WordPress uploads and disposable hosting, suggesting a phishing or malware distribution scheme. The document body is unreadable, but the presence of numerous external URLs strongly supports the attack pattern of redirecting users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/uplcv?utm_term=king+of+avalon+mod+apk+2020 PDF link annotation
    • https://yp05.com/_UploadFile/Images/file/pajigulo.pdfIn PDF document text
    • https://aviatroglo.fr/IMG/file/48672919160.pdfIn PDF document text
    • https://penmypoem.com/new/admin/uploadfiles/file/53986623075.pdfIn PDF document text
    • https://himalmanpower.com/ckfinder/userfiles/files/bomibepi.pdfIn PDF document text
    • http://mispuntossaga.com/campannas/file/rakawolavovekarululifu.pdfIn PDF document text
    • http://bellezaeimagen.com.mx/wp-content/plugins/formcraft/file-upload/server/content/files/161398d2db5505---nesojupofomu.pdfIn PDF document text
    • https://mcq.bmtinhoc.vn/InteriorWeb/images/images_news/files/xobajilomedixu.pdfIn PDF document text
    • http://www.sarajevo-inn-grunewald.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612f22dc95d16---28540412962.pdfIn PDF document text
    • http://daehwa.info/uploaded/file/gulek.pdfIn PDF document text
    • http://studiofantino.it/userfiles/files/fawaxetalanisimatekap.pdfIn PDF document text
    • http://mastrodibaglio.it/userfiles/files/10216502015.pdfIn PDF document text
    • https://www.burit.net/wp-content/plugins/formcraft/file-upload/server/content/files/161395c6cb16cf---12869387544.pdfIn PDF document text
    • http://thuocnam.xyz/images/files/42605053894.pdfIn PDF document text
    • https://mosaicopeoplecorporation.com/ckfinder/userfiles/files/50264369258.pdfIn PDF document text
    • http://highgaincomposites.com/img/file/20219634447.pdfIn PDF document text
    • https://advance-pack.com/editor_upload/file/3406849821.pdfIn PDF document text
    • http://kolaykanal.com/userfiles/files/raruwumilaro.pdfIn PDF document text
    • http://all-premium.com/user_file/files/911122232.pdfIn PDF document text
    • http://vhktn.at/images/content/files/simawerurenerimixafamas.pdfIn PDF document text
    • https://itexpertdog.com/upload/files/jekaxugarem.pdfIn PDF document text
    • http://thanhnienxp.com/vietkiendo/upload/file/75214161189.pdfIn PDF document text
    • https://bahamianbrewery.com/ckfinder/userfiles/files/fosonegetilukolewi.pdfIn PDF document text
    • http://theexplorerthai.com/userfiles/files/tavikufanaj.pdfIn PDF document text
    • http://ulv-fogger.es/d/files/16766688900.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da47.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA47 18136 bytes
SHA-256: c4e77a7d5d652f8bc766759f749316aaf60a1a6184a9ebb986b6ce60eb13bfbb
font_01_sfnt_off000109b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109B3 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000121ca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x121CA 10732 bytes
SHA-256: fdb76cc2abd4b29acc5008c6287b1c675f015656d03856a3a3957a27b0a2ba4a

Open this report in the interactive analyzer, or submit your own file for analysis.