Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8bf848956458fdc…

MALICIOUS

PDF

82.6 KB Created: 2021-09-06 09:50:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: 7caebdd7032ddd0a052efc5b3bde7d3e SHA-1: 82f64e15fb7db3b93582e4982cfbe5f061128db0 SHA-256: d8bf848956458fdc7dc9c78dcc0a8f544aae94b9d1115431f4d458236ef31b5c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, many of which point to compromised WordPress sites and are structured as a link farm. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or distributing further malware. The primary purpose appears to be redirecting users through a network of potentially malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://brylka-kfz.de/wp-content/plugins/formcraft/file-upload/server/content/files/160b4bc71ef711---razivesebukigegalipanajun.pdf In PDF document text
    • http://aaexpansionjoint.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c8999f20875---8612357209.pdfIn PDF document text
    • https://growmytruck.com/wp-content/plugins/super-forms/uploads/php/files/48f13118251c492685cde515c561caa1/binotazivoxenopeg.pdfIn PDF document text
    • http://epoxidice.ro/mm/file/rezalanikotunirenifolotep.pdfIn PDF document text
    • https://lecachet.fr/docs/files/26873120886.pdfIn PDF document text
    • https://gonguyenkhoi.vn/upload/files/46752793809.pdfIn PDF document text
    • http://jeugdopdewetenschapsagenda.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608f11c7934f6---buginitetonuji.pdfIn PDF document text
    • http://beerskiboot.de/img/upload/file/9143289437.pdfIn PDF document text
    • https://qualitycountscleaning.com/wp-content/plugins/super-forms/uploads/php/files/a4ec0f8284f1dae677c926250fc93089/38233530894.pdfIn PDF document text
    • http://vrieshorst.nl/images/uploads/file/pujonujijimotapimo.pdfIn PDF document text
    • http://suportti.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e0acccda55---sedipubob.pdfIn PDF document text
    • http://abwmountvernon.com/uploads/files/86310326832.pdfIn PDF document text
    • http://dodici12.ru/wp-content/plugins/super-forms/uploads/php/files/iu2f9s6igc482mhdfbaebfp9v3/gozel.pdfIn PDF document text
    • http://maszyny.pl/userfiles/file/nutiligep.pdfIn PDF document text
    • https://414movement.com/wp-content/plugins/super-forms/uploads/php/files/064d117d4fbf4945d33953fddb022819/34540664282.pdfIn PDF document text
    • http://www.medical-psychology.gr/wp-content/plugins/formcraft/file-upload/server/content/files/16074d48077479---25845427000.pdfIn PDF document text
    • http://bsbcarpet.com/userfiles/file/kipipaburumifup.pdfIn PDF document text
    • http://2m-m.eu/userfiles/files/livibetipomozi.pdfIn PDF document text
    • http://farmaciafici.com/userfiles/files/50464410630.pdfIn PDF document text
    • https://binhruamuinanobac.com/wp-content/plugins/super-forms/uploads/php/files/ga59kma5tgi7pe8m03fscmjnpj/gowepo.pdfIn PDF document text
    • https://amenagementsoleil.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c6db5bfb11---kolige.pdfIn PDF document text
    • http://khiconghoixuancong.com/Khicong/admin/userfiles/file/19517435574.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=influence+robert+cialdini+pdf+espa%C3%B1olPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA6B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000f27d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF27D 18080 bytes
SHA-256: aeaf4838c4a31ac8c577865c07515b6de44c057d74fafc1fcbef2dfb68ce5ba1
font_02_sfnt_off000120fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x120FE 11008 bytes
SHA-256: d9d1b0c3a791cf626033c0b10577a79196d4debbf6d6e36be16da64f340964df

Open this report in the interactive analyzer, or submit your own file for analysis.