Malicious PDF — malware analysis report

Static analysis result for SHA-256 10bb2c3b696bab45…

MALICIOUS

PDF

70.3 KB Created: 2021-09-05 17:18:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-24
MD5: d3306960317af21cce014a34e229248b SHA-1: 7b5581b3baae8f47b613d2957c4f3692eb792593 SHA-256: 10bb2c3b696bab459a26adcd2ad07ceb38b223685059aa40f62ce772cb60ae91
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains numerous embedded URLs that point to various websites, many of which appear to be compromised or disposable hosting. The heuristic firings indicate it's a link farm designed to direct users to external content, likely for phishing or malware distribution. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6865

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/uplcv?utm_term=edit+pdf+online+word PDF link annotation
    • https://www.stamfordtaxis.com/wp-content/plugins/super-forms/uploads/php/files/e3brh1cj312imbirlhi55a2lu4/45760669221.pdfIn PDF document text
    • http://argentum.com/wp-content/plugins/super-forms/uploads/php/files/f7pa2fe546kfnm379d37dmtvnc/57307989545.pdfIn PDF document text
    • http://www.akutrans.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c0427a1de6---92163765986.pdfIn PDF document text
    • http://eszixv.hu/ckfinder/userfiles/files/66643000087.pdfIn PDF document text
    • https://btegypt.com/file/14692969042.pdfIn PDF document text
    • http://www.trimbleexpress.sk/wp-content/plugins/formcraft/file-upload/server/content/files/160d5773d55256---jinegasojuripumowop.pdfIn PDF document text
    • http://stlukesmn.org/clients/17773/File/fidasigokalejizivez.pdfIn PDF document text
    • http://www.nisbd.com/wp-content/plugins/formcraft/file-upload/server/content/files/1611bdeb8b8512---78583627224.pdfIn PDF document text
    • http://a-kamen.com/userfiles/file/wunezawilirobevi.pdfIn PDF document text
    • http://modelkyujin.com/wp-content/plugins/formcraft/file-upload/server/content/files/160af83188e333---92404604189.pdfIn PDF document text
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/em9majsfl4ut2suvhibpspc2jv/dawivetak.pdfIn PDF document text
    • http://vetcarefoundation.org/userfiles/file/48902153353.pdfIn PDF document text
    • http://aunay-sous-auneau.fr/ckfinder/userfiles/files/ripatujejodeli.pdfIn PDF document text
    • https://tsegypt.com/file/12680633938.pdfIn PDF document text
    • https://gimenezricarte-deltabogados.com/ckfinder/userfiles/files/98240085140.pdfIn PDF document text
    • https://doosradashak.in/ci/userfiles/files/linexetuzexusup.pdfIn PDF document text
    • http://flambotour.it/themes/userfiles//files/jowegodelubepowobumagevot.pdfIn PDF document text
    • http://yaqeen-eg.com/userfiles/file/43078303338.pdfIn PDF document text
    • https://biharlokmanch.org/userfiles/file/89414427759.pdfIn PDF document text
    • http://seamacros.com/upload/file/58468013028.pdfIn PDF document text
    • http://ecovn.vn/uploads/news_file/32175773517.pdfIn PDF document text
    • http://ctnphrae.com/ckfinder/userfiles/files/minujofomodo.pdfIn PDF document text
    • https://provisionsinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082a9cdb8931---tefivusexibajapovi.pdfIn PDF document text
    • https://www.arphplumbing.co.uk/wp-content/plugins/super-forms/uploads/php/files/ge6686d7jrsnkjq72pop078e49/netoxofozo.pdfIn PDF document text
    • https://svetpoznaniyaonline.ru/wp-content/plugins/super-forms/uploads/php/files/e5980b2f982ad55ab3fc7c962a366a93/87186532830.pdfIn PDF document text
    • http://theloanwala.com/userfiles/file/feloxiwisapasuxaj.pdfIn PDF document text
    • http://www.goataxiservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a67567c77bf---59557613177.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED16 10232 bytes
SHA-256: 5536b6882e8363d92ca80c7d83e3904eacb489b1a26f95a0490694f2890f4735

Open this report in the interactive analyzer, or submit your own file for analysis.