Malicious PDF — malware analysis report

Static analysis result for SHA-256 201e7bbb0b84d1c1…

MALICIOUS

PDF

617.1 KB Created: 2021-06-25 07:51:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: bf42dd60eacf924b4e0b528bd945ec7d SHA-1: f0f25e8c783480a69eff26ca6c982828d678e6fe SHA-256: 201e7bbb0b84d1c1879d992bc8eee8aeb4a45bbb019bcaaecb2621110597d1a2
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV with a Pdf.Phishing.Trojan signature. It contains numerous links to external websites, many hosted on compromised WordPress installations, suggesting a phishing or malware distribution campaign. The document body, though heavily obfuscated, appears to be a lure related to an academic paper, likely to trick users into clicking the malicious links.

Machine Learning

  • Nyx PDF Classifier clean score 0.1935

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ketchas.ru/uplcv?utm_term=introduction+to+probability+jessica+hwang PDF link annotation
    • https://kindliving.org/wp-content/plugins/super-forms/uploads/php/files/tmp/semivudowaxu.pdfIn PDF document text
    • http://www.iamgoingto1996.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b68f17e2ad---jature.pdfIn PDF document text
    • https://qualitycountscleaning.com/wp-content/plugins/super-forms/uploads/php/files/0251d193aab7b5d559f80428dd7ecaa3/kunetevejeveziretosiga.pdfIn PDF document text
    • https://www.siemers-deutschmann.de/wp-content/plugins/super-forms/uploads/php/files/cqb3lmufdit6jknto99jjbrv2k/maneluxavutexivopizijali.pdfIn PDF document text
    • https://www.beachesbrewing.com/wp-content/plugins/super-forms/uploads/php/files/99d3b8c2c2a75e77bd15a5416086a7b6/gepeg.pdfIn PDF document text
    • https://messianic.live/wp-content/plugins/super-forms/uploads/php/files/8c26f9fac9db0486f8da5cc8c82e91ef/ziporenabe.pdfIn PDF document text
    • https://wpsqld.com.au/wp-content/plugins/super-forms/uploads/php/files/0ba4e528357dfbb7e584cf00f0c13482/gewula.pdfIn PDF document text
    • https://ahi.com.ua/wp-content/plugins/super-forms/uploads/php/files/9516241f99a518c1d3b9a5a4574c64e2/buwero.pdfIn PDF document text
    • http://www.dadosefatos.net.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609a2dd681423---22652419114.pdfIn PDF document text
    • http://nanobubblevietnam.com/uploads/userfiles/file/357474624.pdfIn PDF document text
    • http://boxethai38.com/upload/file/50108998186.pdfIn PDF document text
    • http://ippinnudon.com/uploads/files/10230910209.pdfIn PDF document text
    • http://geteffective.biz/uploadfiles/file/lukasiv.pdfIn PDF document text
    • http://aven.su/userfiles/file/65879461348.pdfIn PDF document text
    • http://www.neslihanonur.com/wp-content/plugins/super-forms/uploads/php/files/d44d8f95a1b35e15177a3bdd572cc6a2/60728662936.pdfIn PDF document text
    • https://glass-haus.ru/wp-content/plugins/super-forms/uploads/php/files/daf82af2e7ae4668515a93e6a1786442/12557473274.pdfIn PDF document text
    • http://www.typoland.com/http://www.typoland.com/designers/Lukasz_Dziedzic/CopyrightIn PDF document text
    • http://www.typoland.com/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00095d65.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x95D65 6168 bytes
SHA-256: 50bd8db5ff9a0f03ea6ac0366ab4ff273dceb6ff0c6101ac0faff1fd52ccc92d
font_01_sfnt_off00096d07.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x96D07 5680 bytes
SHA-256: f6e8e5ef2239927a1b21d1073528ad5110737b0771e4b1c039bb0ebced4e1e6f
font_02_sfnt_off00098066.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x98066 2464 bytes
SHA-256: 4afd30a5e7e9ae77960b833eeedf660a1f85925328f6a17d0dfa581b5fce84a1

Open this report in the interactive analyzer, or submit your own file for analysis.