Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8a151ae3105e191…

MALICIOUS

PDF

69.0 KB Created: 2021-06-13 19:21:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 68151afa4fba2758a6f9e0c3a9d27266 SHA-1: b19e6a1813baa0aec3284d4c4b77287e25528c3a SHA-256: c8a151ae3105e191926124a190004253223905ade245046ba95c6d23d525569a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document contains numerous embedded URLs, many pointing to compromised WordPress sites and disposable hosting, suggesting it functions as a link farm for phishing or malware distribution. The presence of a URL with a UTM term also indicates a potential phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/uplcv?utm_term=arnold%2527s+blueprint+to+mass+phase+2 PDF link annotation
    • https://www.finestkindcharter.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a0d9d609472---verujojunopeja.pdfIn PDF document text
    • https://amrapalispot.com/userfiles/file/63003194217.pdfIn PDF document text
    • https://signaturetowerpune.com/wp-content/plugins/super-forms/uploads/php/files/dh0intk9lnqv0plahjppgrhiu3/71200575029.pdfIn PDF document text
    • https://eduinfinite.com/wp-content/plugins/super-forms/uploads/php/files/84bc89db6bf3c2420d56e2bf8f5d39eb/17848941671.pdfIn PDF document text
    • https://archltginc.com/wp-content/plugins/super-forms/uploads/php/files/22df6e4e3f01f81799ad9026f92989f5/80693362718.pdfIn PDF document text
    • http://group-anons.ru/userfiles/files/nizodelazukam.pdfIn PDF document text
    • http://hi-reid-solutions.com/wp-content/plugins/super-forms/uploads/php/files/559200192d078d52da20f550f2355f64/dosokunipolagalesisita.pdfIn PDF document text
    • https://www.grandeprairie.org/wp-content/plugins/formcraft/file-upload/server/content/files/1609f1aafab80f---78128912455.pdfIn PDF document text
    • http://leebyunghun.kr/new/upload/board/files/97237214707.pdfIn PDF document text
    • https://fortlauderdale-carservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609060d225999---44496576932.pdfIn PDF document text
    • http://lotuscourtpune.com/wp-content/plugins/super-forms/uploads/php/files/t8ii114s6vbc7d2e74chg11fm3/55781839663.pdfIn PDF document text
    • http://www.loockuniformes.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/160ac161752bc4---keduro.pdfIn PDF document text
    • http://for-rent-antwerp.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609baed1453d4---14303979118.pdfIn PDF document text
    • https://aliencosmicexpo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086e7c7370cc---75971864492.pdfIn PDF document text
    • https://realestateconnect.biz/wp-content/plugins/super-forms/uploads/php/files/4tojfjqm81m3uj4uq31i4djr17/13569789675.pdfIn PDF document text
    • https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071d8f6a4a53---buwigasux.pdfIn PDF document text
    • https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160be261686e55---20490259696.pdfIn PDF document text
    • http://iamsoldierfit.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ad8fac6469---junoduvebosimodabiz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cfa5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCFA5 5492 bytes
SHA-256: ff71f85638907d2a8ab4b97789a3515da4fd9b75eec77ad77631e47419d04716
font_01_sfnt_off0000e222.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE222 10664 bytes
SHA-256: 897d1c5479eef4ea9f8fca65b79068d6155ec33d1fcda904e15387e8ce6b7b89

Open this report in the interactive analyzer, or submit your own file for analysis.