Malicious PDF — malware analysis report

Static analysis result for SHA-256 182c96df75abca65…

MALICIOUS

PDF

63.9 KB Created: 2021-06-08 10:03:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 79660fd9e566665c8792a52635041a27 SHA-1: c9ac5fbcfcc52f63877df0f487282fe352ddac8a SHA-256: 182c96df75abca65fc6121a9e51b94057fa331f4315d3f763293570de6f9e2cd
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm pointing to numerous domains, many of which appear to be compromised WordPress sites or disposable hosting. The heuristic firings indicate this PDF is part of a link farm strategy, likely to obscure malicious redirects. While no scripts were explicitly extracted, the presence of external URIs and the nature of the link farm suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8599

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://krisoc.ru/uplcv?utm_term=how+to+teeth+whitening+pens+work PDF link annotation
    • http://faurerom.com/userfiles/file/21795175342.pdfIn PDF document text
    • http://audiencefertilization.com/fckeditor/editor/filemanager/connectors/php/userfiles/file/30569170069.pdfIn PDF document text
    • https://www.pennlighting.com/wp-content/plugins/super-forms/uploads/php/files/53cd4111ce6069ed13c97e5b643d1bc5/25971110993.pdfIn PDF document text
    • http://terapie-psi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607761a653204---kolukafota.pdfIn PDF document text
    • https://mercedesmazo.es/wp-content/plugins/formcraft/file-upload/server/content/files/160a953ed60b00---fepudolilepisimaxerolaj.pdfIn PDF document text
    • https://www.zulilighting.com/wp-content/plugins/super-forms/uploads/php/files/3782aadebe137169e0ffdc9ec7999bb1/vidafoxud.pdfIn PDF document text
    • https://humanistbeauty.com/wp-content/plugins/super-forms/uploads/php/files/j00ruu4u8bo4jiitq391murju2/ligogewopose.pdfIn PDF document text
    • https://idfusionllc.com/wp-content/plugins/super-forms/uploads/php/files/d8bc437b2c999ecc785b92bc3dcf7a27/76009680288.pdfIn PDF document text
    • https://www.hungryalex.com/wp-content/plugins/super-forms/uploads/php/files/202c960e5dc06a08088fd0b18493cc6b/folizixu.pdfIn PDF document text
    • https://clubforeducation.com/FCKeditor/userfiles/file/wegevetuzetamazofenaz.pdfIn PDF document text
    • https://xn--64-mlcufjjaii0l.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/7c1413ee34206700b22a56792abd8c63/95760303402.pdfIn PDF document text
    • http://xn--80ackbssfuieecff0e8c.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/0al7r78j7geqkv3sd86tge0mm0/17307057131.pdfIn PDF document text
    • https://sygimportaciones.com/wp-content/plugins/super-forms/uploads/php/files/kfnt6jbo8skpoq7remqqcfjr6b/10516515932.pdfIn PDF document text
    • https://glosunspa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b3abaeedde---felalozatudozizirafikor.pdfIn PDF document text
    • http://sad-azov.ru/wp-content/plugins/super-forms/uploads/php/files/cbc37207c6d2919744090ecfe7086b5f/boxawapaniduxedif.pdfIn PDF document text
    • https://www.kngroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cec7780407---zamoje.pdfIn PDF document text
    • https://razvozka24.ru/wp-content/plugins/super-forms/uploads/php/files/f1bde96c7f5184b978653e3de16a0456/51007248136.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://lovewhereyoulv.wpengine.com/wp-content/plugins/super-forms/uploads/php/files/5e5f8359958464c3f4731c6b1c7577f8/tidagitolik.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d506.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD506 4956 bytes
SHA-256: 51296a71596e5e1ab3e529dff80f885ee017b78370e0c1b16e6bafbd399baa9f

Open this report in the interactive analyzer, or submit your own file for analysis.