Malicious PDF — malware analysis report

Static analysis result for SHA-256 25d297bc3be294ac…

MALICIOUS

PDF

71.7 KB Created: 2021-05-10 04:42:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7bacdbebc08c71671a59754558072ead SHA-1: 55cf5aaab5bca54d3995b33ae4c5247dd4fe6ef4 SHA-256: 25d297bc3be294ac8aef7415b199efebc949e524ee2b597fed0968f1fb9855f8
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The document contains numerous URLs pointing to compromised WordPress sites and other disposable hosting, functioning as a link farm. The primary purpose appears to be directing users to malicious content, likely for phishing or malware distribution, as indicated by the 'ML_NYX_PDF_MALICIOUS' score and the presence of external URI links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7772

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/uplcv?utm_term=melhor+aplicativo+espi%25C3%25A3o+para+android+gratis
    • https://rosemonttherapy.health/wp-content/plugins/super-forms/uploads/php/files/lag326mgo0o6o7ebl56bqdl8h8/9393277697.pdf
    • https://mfdesign.hu/files/file/19760591703.pdf
    • http://blog.crowdly.com/wp-content/plugins/formcraft/file-upload/server/content/files/160840977a3b7d---luzomitalonukugigomozulu.pdf
    • http://anhuifan.com/upload_fck/file/2021-5-10/20210510043308452530.pdf
    • http://iccj.jp/images/uploads/fckeditor/file/40871535456.pdf
    • http://elenasteele.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608de06e121ac---31147987967.pdf
    • http://sevimticaret.net/userfiles/file/valesawakametumatajap.pdf
    • https://ambientltg.com/wp-content/plugins/super-forms/uploads/php/files/b567b84a40a034549b3418c8e13c6674/fukifinebosusavupad.pdf
    • https://www.corridar.com/wp-content/plugins/super-forms/uploads/php/files/mccshnr8nev89ica4e1snf1jhg/jibavazelunovoxefexexuju.pdf
    • https://www.dentaltaxpros.com/wp-content/plugins/super-forms/uploads/php/files/d1d23602ccd8991322c7794d39af4dcc/vekibolex.pdf
    • https://harpethvalleyhealth.com/wp-content/plugins/super-forms/uploads/php/files/668a0aa0db3c8d6e7a92980a7b3abba6/falewogiveme.pdf
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160711888ee069---zawejinugare.pdf
    • http://gentlemensquartersbarbershop.com/wp-content/plugins/super-forms/uploads/php/files/47fff4c226fb6ed4fdca2d10d8149c47/55016775531.pdf
    • https://airshow-bg.com/file/xivopuguruwomibes.pdf
    • http://bascobrunswick.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607df22721cb5---xitovizivagururod.pdf
    • https://aryaayur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609098562b4ac---67401020289.pdf
    • https://mrmusicfoundation.org/wp-content/plugins/super-forms/uploads/php/files/uchnq0lbfdiujbvde8ucesjkf1/komonaxisisulo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee11.bin
ac66ddecb1889e99694234647e4a1e19b6174440e696c9ee44c6cb9711419273		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE11 3312 bytes
font_01_sfnt_off0000f9f2.bin
abde54c20d4a5dc7e229d76626e04999b732dc00c90ff3d56bd0094cf6b9e87a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9F2 5716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.