Malicious PDF — malware analysis report

Static analysis result for SHA-256 0686f12350ee8a39…

MALICIOUS

PDF

73.0 KB Created: 2021-06-09 12:45:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 597b6360e73e8037569b9ba6b705bd3f SHA-1: 31fbf3eb6e40ecd93acc7811211e4b3cbe800a1b SHA-256: 0686f12350ee8a397a71b57046eef7938b12232b502d93051364f075a1eaf13a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or malware distribution attempt. It contains numerous links, many pointing to compromised CMS uploads or disposable hosting, forming a link farm. The URL 'https://garglob.ru/uplcv?utm_term=how+to+calculate+mj+cm2' is a primary indicator of this redirection behavior. No scripts were extracted, but the structure suggests a lure to external malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7243

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garglob.ru/uplcv?utm_term=how+to+calculate+mj+cm2
    • http://lyshiying.com/d/files/17986421172.pdf
    • http://www.jindatunnel.com/up_files/file/panosimiremededojosater.pdf
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/1tq4jss39ohip3mud99sa6s2hg/35076030141.pdf
    • https://www.enviedecrire.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bc1b182c5a9---kulesonebonunijovugowaxux.pdf
    • https://www.vibrationmonitoring.asia/wp-content/plugins/formcraft/file-upload/server/content/files/16090e5c472419---29449613906.pdf
    • https://mithermomix.com.mx/wp-content/plugins/super-forms/uploads/php/files/a9209698908674ea81be3ed2cab30a4c/63911526782.pdf
    • https://tecsal.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16080195269ebe---gurezewibe.pdf
    • http://kudusde.org/resimler/files/bipopeliso.pdf
    • http://www.cargeacrew.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16092beabb5c27---79095916253.pdf
    • https://www.americanapi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b4c577c2b93---saramun.pdf
    • http://lushexperiences.com/wp-content/plugins/formcraft/file-upload/server/content/files/160797cf257407---guxakarelilupazifaresopeb.pdf
    • https://estoniapools.com/contents//files/20068265325.pdf
    • http://allprintusa.com/admin/images/file/vodanefimarikijigemem.pdf
    • https://www.tonygssoulfood.com/wp-content/plugins/super-forms/uploads/php/files/87f0f75168c813164922bcc957b77baf/fixodoj.pdf
    • http://basyapiemlak.com/yukleme_klasoru/userfiles/file/12932027774.pdf
    • http://cuuhoatudong.com/upload/files/pabonolenokigodud.pdf
    • https://wpsqld.com.au/wp-content/plugins/super-forms/uploads/php/files/fc1d1b3731b5d28315c3ebc4daeb5465/85866940700.pdf
    • https://careersourceokaloosawalton.com/files/public/fojokitaxogonofigerumuvix.pdf
    • https://lightsourceindiana.com/wp-content/plugins/super-forms/uploads/php/files/e15509b428a35e7d1bb7639f6a902057/xanomaxukoj.pdf
    • http://joelcsimonesq.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/93133562232.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e90e.bin
c9d1e73e368552e6e3c3d9cf0df9750f0ed9016ad02dcff36b519a08699dd3cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE90E 4932 bytes
font_01_sfnt_off0000f9d8.bin
89fcb4f7296047c9a6628ada0576a9b464c3120fdc0412fde55df1f8de5f4e3b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9D8 12000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.