Malicious PDF — malware analysis report

Static analysis result for SHA-256 1db5f4f4e616d1f7…

MALICIOUS

PDF

304.0 KB Created: 2021-06-24 05:16:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 97ad8acc486cfdcad413968a9cc3a5e3 SHA-1: 8eb931b35157cc0dae1f9dc7906f3829b10f3aef SHA-256: 1db5f4f4e616d1f75136d1021eb5b1b4b9b820cbdcc9dddfdc96e11ac87873a8
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The presence of numerous links pointing to compromised WordPress upload storage and other unknown URLs suggests a phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and link farm indicate an intent to redirect the user to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9571

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://roweryelectra.eu/app/webroot/uploads/file/1619871577465.pdf In PDF document text
    • https://zzarosiscarampola.it/file/fulufonuxotekoruzob.pdfIn PDF document text
    • https://ludifrance.fr/userfiles/file/vuxumidoluvorivewu.pdfIn PDF document text
    • http://pferdefreunde-brueckenhof.de/sites/default/files/userfiles/file/nozezalofukonajas.pdfIn PDF document text
    • http://sivam.pl/files/file/73241833652.pdfIn PDF document text
    • https://uleshuzataruhaz.hu/files/file/mufakaxuxikuzap.pdfIn PDF document text
    • http://mintaialuminum.com/d/files/24994633385.pdfIn PDF document text
    • https://www.quatainvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160816229a0678---45018218950.pdfIn PDF document text
    • http://www.cuadernos.in/wp-content/plugins/formcraft/file-upload/server/content/files/160965c1be29f7---3124410216.pdfIn PDF document text
    • http://www.etoiles-recrutement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c8ed34d1311---nezikotisokusipu.pdfIn PDF document text
    • https://svetpoznaniyaonline.ru/wp-content/plugins/super-forms/uploads/php/files/8e9f25e725ebe788ed81399e0cc6b3a7/60568376617.pdfIn PDF document text
    • http://www.bestlifepolicy.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1609082e06a84a---87214371694.pdfIn PDF document text
    • https://shen-su.eu/gfx/userfiles/files/duzofabitemuv.pdfIn PDF document text
    • https://mebelpozakazu.ru/wp-content/plugins/super-forms/uploads/php/files/1b03918cf242c0e47aaa47e241d45820/fodubi.pdfIn PDF document text
    • http://amfmeg.org/wp-content/plugins/formcraft/file-upload/server/content/files/160b3e30d2ef9c---16114490009.pdfIn PDF document text
    • http://www.nisbd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a8b9bd533f6---38561228676.pdfIn PDF document text
    • http://www.canadavisaservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/16097650a5ebef---20400312735.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/LPIa9PGmDLg/uplcv?utm_term=quiz+diva+roblox+quiz+answers+2020PDF link annotation
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00044687.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x44687 15904 bytes
SHA-256: da69c102ddca1eb3f746402c1ea0efb39315944575defcf3fe6a4e54891f73a3
font_01_sfnt_off000479e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x479E0 5492 bytes
SHA-256: 264dc6a0b3508fc9609f431d2453ebfb4ace03cce13b5264f35bc665c59be271
font_02_sfnt_off00048cac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x48CAC 21528 bytes
SHA-256: 25f77f4a61990703011c0a6364de106e08d8eb4d7c9ec2985c6f69de28092615

Open this report in the interactive analyzer, or submit your own file for analysis.