Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b8aacdd60ca5b42…

MALICIOUS

PDF

69.3 KB Created: 2021-08-11 13:54:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12
MD5: 9d044b9dd1ae35fac849b3c4f714dafb SHA-1: aff6951e78b8709bfdfa9721e0eae53fb3b5eb2e SHA-256: 9b8aacdd60ca5b42bf037dbbc47dd6428c195dd5845bb289e4defc2ee62be1b8
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was detected by ClamAV as Pdf.Phishing.Trojan and flagged by an ML classifier, indicating malicious intent. It contains a link farm pointing to compromised WordPress sites, likely serving as a lure for phishing or malware distribution. The presence of multiple external URIs and the PDF_SEO_DISPOSABLE_LINK_FARM heuristic suggest a coordinated effort to host malicious content on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9750

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/uplcv?utm_term=luna+de+miel+en+familia+pelicula+completa+en+espa%C3%B1ol+descargar PDF link annotation
    • http://gsoam.ge/wp-content/plugins/formcraft/file-upload/server/content/files/160cbecbe35240---verekifodopuruzupodesanu.pdfIn PDF document text
    • http://careerhack.net/wp-content/plugins/formcraft/file-upload/server/content/files/160c133540b9f4---basasojisada.pdfIn PDF document text
    • https://adsbudget.net/userfiles/file/47350758763.pdfIn PDF document text
    • https://observatoire-omic.org/documents/file/80892512685.pdfIn PDF document text
    • https://riverasphotovideo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078afc4875af---87919932663.pdfIn PDF document text
    • http://southport1969.com/clients/861680/File/98881119120.pdfIn PDF document text
    • http://1night2day.com/UserFiles/file/4182591091.pdfIn PDF document text
    • https://www.sgestrecho.es/wp-content/plugins/formcraft/file-upload/server/content/files/1607f9629cb54d---88274579213.pdfIn PDF document text
    • http://thementalhealthadvocates.org/files/userfiles/file/90376520629.pdfIn PDF document text
    • http://host.keraladreamhomes.com/~viswabrahmathach/admin/fckeditor/editor/filemanager/connectors/php/userfiles/file/ligebigojizejufigaxu.pdfIn PDF document text
    • https://i3mit.com/shopadmin/upload/files/9115930324.pdfIn PDF document text
    • https://luxmarketing.agency/wp-content/plugins/super-forms/uploads/php/files/oub65vano376khitfvmcctpju1/32265876146.pdfIn PDF document text
    • http://www.pattyn360.com/upload/forum/files/nolasexikunagabotoloroxu.pdfIn PDF document text
    • http://itaindustrial.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607b70cf5d446---zizodapaweguz.pdfIn PDF document text
    • http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609a08655e59f---kesofisusobolaveso.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d083.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD083 3252 bytes
SHA-256: e503b43404c33d904ca15b6d116415df4d7369f829e25dd5d6ddac6739812f76
font_01_sfnt_off0000dd80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD80 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0000f597.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF597 11228 bytes
SHA-256: 68af4ac0d6dcb1a3ddcce6fb6798644ca6e0b9e4be90e0e7a824943140ef2dca

Open this report in the interactive analyzer, or submit your own file for analysis.