Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef8927a9ec01e444…

MALICIOUS

PDF

88.5 KB Created: 2021-07-06 09:52:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: 1eb02a185f42b26a0304f733f6538277 SHA-1: 19aa2b45527b72da5b3243ea2ed4c83d9a6aa720 SHA-256: ef8927a9ec01e4444f62f7d7f2327f895d3eea59b5dacf526f039ed67525a229
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was identified as malicious by a machine learning classifier and ClamAV. It contains a large number of links, many pointing to compromised websites or disposable hosting, suggesting it functions as a link farm. The presence of UTM parameters in some URLs indicates a potential phishing or traffic-driving campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/uplcv?utm_term=manny+pacquiao+fight+stream+reddit PDF link annotation
    • https://detector-billetes.com/Imagenes/file/73752932656.pdfIn PDF document text
    • http://marta-galan.com/files/varios/file/temolozaxadex.pdfIn PDF document text
    • https://utilitydiscount.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b29d1172d93---kotiguwebelavufaxurige.pdfIn PDF document text
    • https://tectrongim.com/uploads/files/31860929274.pdfIn PDF document text
    • https://haps.company/wp-content/plugins/super-forms/uploads/php/files/v1oq9uq8p233ftbk4if3s88567/rajogemijafavumuw.pdfIn PDF document text
    • http://www.agrosystem.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16088bdfa7aef8---zagexoxiva.pdfIn PDF document text
    • http://kennyre.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c246b381a9b---basekitedojilurijabodi.pdfIn PDF document text
    • http://webinaris.net/ckfinder/userfiles/publics/files/zatuxubekanisugulejod.pdfIn PDF document text
    • https://sasalidayanisma.org/uploads/file/46006023339.pdfIn PDF document text
    • https://alamansyria.com/userfiles/file/61814933080.pdfIn PDF document text
    • https://bowenpainter.com/wp-content/plugins/formcraft/file-upload/server/content/files/160833af2d086d---fakojatefabotil.pdfIn PDF document text
    • http://dlzj.net/upload/files/20210622232627161989.pdfIn PDF document text
    • https://evenimentecastel.ro/wp-content/plugins/super-forms/uploads/php/files/ij8bsum211bk4efcs8g2iaq2ud/xujawimopopusax.pdfIn PDF document text
    • http://ibshop.gr/uploads/_uploads/files/sekigezekeruw.pdfIn PDF document text
    • http://dermaktif.com/imgup/file/35807006251.pdfIn PDF document text
    • https://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160708d54cc796---dotosoluwisesunu.pdfIn PDF document text
    • http://gps-tw.com/CKEdit/upload/files/14856680982.pdfIn PDF document text
    • https://ceilford.org/wp-content/plugins/super-forms/uploads/php/files/aa4b3da81e3e8e3eb3196c1bb0951dfd/gurunu.pdfIn PDF document text
    • https://xn--1--8kcai1ck2bs.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/f765bb6adac37227cb6f039c223b2b4d/fobivipuvadej.pdfIn PDF document text
    • https://mytutr.com/wp-content/plugins/super-forms/uploads/php/files/1e6c21a85b1162f7db3f96721477e4d1/womujabewoxe.pdfIn PDF document text
    • http://adhdadvisory.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e3cee8123d---82297739511.pdfIn PDF document text
    • https://maloneslandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/160baa0f794302---foguviwozexon.pdfIn PDF document text
    • https://capitaleny.com/wp-content/plugins/super-forms/uploads/php/files/d8fc1e3dee1ddeaf6915ab5ade49fc1c/vonowibakefuw.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f04c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF04C 19120 bytes
SHA-256: 1ca4bf1c0ce581b6ef511c0e23143edf92f6870f0c7b2eb7985e6eda47235ba3
font_01_sfnt_off0001226c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1226C 11372 bytes
SHA-256: 6f0e81401bbf20c49e482a33d4af94a5b3c178bf9859f895ffd6fadaf6e8f5a5
font_02_sfnt_off00013c9a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13C9A 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.