Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c6c859c9d1de777…

MALICIOUS

PDF

74.0 KB Created: 2021-09-06 13:52:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 9905a46d0a91754e5556228b804e0113 SHA-1: 918d36817a952a0a65a78efec331dcce8c189d4d SHA-256: 9c6c859c9d1de7774f6903ea565f5562b763c45c060d646d55b5c0c457b47d2a
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. Multiple heuristics point to the PDF containing a link farm with numerous external URIs hosted on compromised or disposable domains, suggesting a phishing or malware distribution scheme. The presence of these links indicates an attempt to redirect the user to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/uplcv?utm_term=the+political+economy+of+health+doyle+pdf PDF link annotation
    • https://terravistahometeam.com/wp-content/plugins/super-forms/uploads/php/files/e493661e430eca868e772ee8685bf50b/guledemupejatedivukum.pdfIn PDF document text
    • http://157.230.241.115/image/upload/File/zabenu.pdfPDF link annotation
    • http://esistore.be/userfiles/file/kirukajefalolali.pdfIn PDF document text
    • https://socialchangefactory.org/wp-content/plugins/super-forms/uploads/php/files/318121608c4429f70e9c47e1b2527ccd/51053641640.pdfIn PDF document text
    • https://sevsport.info/wp-content/plugins/super-forms/uploads/php/files/5585f4d0e6d9ee48ab1bc2f1d85fd238/mojamijeporanumesivibafuv.pdfIn PDF document text
    • http://dok-vo.ru/userfiles/file/bewodamojikowobuzexuwivan.pdfIn PDF document text
    • https://www.lightingsolutionsal.com/wp-content/plugins/super-forms/uploads/php/files/610977b774185ad16ea16698367369b2/33012205127.pdfIn PDF document text
    • https://photographerin.agency/wp-content/plugins/super-forms/uploads/php/files/68701i8joiq29c39qd2v9uim35/48490599976.pdfIn PDF document text
    • http://baihsad.com/userfiles/files/20210809_144658.pdfIn PDF document text
    • https://www.mnspineandsport.com/wp-content/plugins/super-forms/uploads/php/files/56a64ec8f8d0ed519ef5a2a38f89924c/tomijonibafilaniro.pdfIn PDF document text
    • https://pristineleather.com/userfiles/file/28143210640.pdfIn PDF document text
    • http://accurateverdicts.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b3811f2464a---sevojozasuzorutopasotifat.pdfIn PDF document text
    • http://drukarnia-warszawa.pl/pliki/file/18977527797.pdfIn PDF document text
    • http://bakefruit.com/uploads/files/202108250952072129.pdfIn PDF document text
    • http://timatey.kz/wp-content/plugins/super-forms/uploads/php/files/lci9agqs78dc8dfe3ha96tl753/92679248841.pdfIn PDF document text
    • https://www.sehersirin.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073150f30349---sozesoxevefasulerowuki.pdfIn PDF document text
    • https://cubic.is/userfiles/file/jilupiwaxamikuf.pdfIn PDF document text
    • https://www.criteriainvest.com.br/wp-content/plugins/super-forms/uploads/php/files/h4jvk2i360kppi6vmmjpgitsoq/27647246655.pdfIn PDF document text
    • https://amiablediamonds.com/wp-content/plugins/super-forms/uploads/php/files/a516cde59a5f23912692dc59ca44d674/41413148243.pdfIn PDF document text
    • http://www.psstrecno.sk/wp-content/plugins/formcraft/file-upload/server/content/files/160c287541a423---1983587810.pdfIn PDF document text
    • http://lungshingcentre.com/userfiles/julamolivigivikuposaren.pdfIn PDF document text
    • http://hanart21.com/files/userfiles/file/torinij.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000be16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBE16 17184 bytes
SHA-256: 20f160edf3b2818355094e979a24a80c1deb2ea449a16985a1f200b821ae4734
font_01_sfnt_off0000e9fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9FA 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00010211.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10211 10692 bytes
SHA-256: fca912622d54159a9d45f15491bd5c7d060bf6c1d60f07b58c0c3722232fced2

Open this report in the interactive analyzer, or submit your own file for analysis.