Malicious PDF — malware analysis report

Static analysis result for SHA-256 275060cb85c2da2d…

MALICIOUS

PDF

84.6 KB Created: 2021-07-24 07:44:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: 52d609f050a5fed785d0aceaeae249b7 SHA-1: fd527945ff8839182ffd8786d1d5c492da73bcc5 SHA-256: 275060cb85c2da2da72e400cd5b5bda777c2ab41e740d9f113dfce0ea0e96379
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a link farm pointing to multiple compromised websites, which in turn host other PDF files. This suggests a multi-stage attack, likely for phishing or malware distribution, where the initial PDF serves as a lure to further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9500

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catherinehourihan.art/wp-content/plugins/super-forms/uploads/php/files/617580e94dd28ce306188b8f0b7b5109/zutadukimevujuse.pdf In PDF document text
    • http://unseretochter.com/images/file/5869050579.pdfIn PDF document text
    • https://mszukam.pl/dat//file/4697296380.pdfIn PDF document text
    • https://adbadog.com/wp-content/plugins/super-forms/uploads/php/files/c1aa821db5dc5f44d7d29ff7b8d7b51e/sidosovupososu.pdfIn PDF document text
    • http://ordinate-ltd.com/file_media/file_image/file/biwazixaf.pdfIn PDF document text
    • https://mithermomix.com.mx/wp-content/plugins/super-forms/uploads/php/files/1b2b4e2b66a3cb2dc0331791d997a3fd/17320536921.pdfIn PDF document text
    • https://www.kiakaha.gr/wp-content/plugins/super-forms/uploads/php/files/snmukq5p3pa7v0lptd2ak6ngtg/fujuvebemiwipedadafodurit.pdfIn PDF document text
    • https://ecef-groupe.com/wp-content/plugins/super-forms/uploads/php/files/t6klrs323gsgkpmptmi1tc3jd7/kemevigaragola.pdfIn PDF document text
    • http://www.bewegeninarnhem.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c954a14a9f5---jejukujo.pdfIn PDF document text
    • http://brodart01.com/wp-content/plugins/super-forms/uploads/php/files/7835fj633705l5jtmuq9h5ro4d/87752036322.pdfIn PDF document text
    • http://www.playerclub.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16098dbd3ae8ac---779519387.pdfIn PDF document text
    • http://www.louthadventures.ie/wp-content/plugins/formcraft/file-upload/server/content/files/160811e9c6c60c---36264955201.pdfIn PDF document text
    • https://blackknowledge.com/wp-content/plugins/super-forms/uploads/php/files/5e45532d9fae94e34710c4e88e496068/80511868633.pdfIn PDF document text
    • https://www.hungryalex.com/wp-content/plugins/super-forms/uploads/php/files/tj6sbmb4kphhjimoqt8s5p17ca/54888471837.pdfIn PDF document text
    • https://kenkochaya.com/user_data/ckfinder/files/jipigaje.pdfIn PDF document text
    • http://uat.ideadunes.com/projects/ideadunes-portfolio-site/wp-content/plugins/formcraft/file-upload/server/content/files/1608e1db25a48f---31471803381.pdfIn PDF document text
    • https://storage-in-motion.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609839e883ab8---topesizuk.pdfIn PDF document text
    • http://a-range.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160af9cb0f3ee1---18938538665.pdfIn PDF document text
    • https://tanthuantelecom.com/upload/fck/file/lufadejotizojiliki.pdfIn PDF document text
    • http://banlinhkienlaptop.com/userfiles/file/kuvasadapujagi.pdfIn PDF document text
    • http://theydeserveastamp.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a51a0e1526d---60939502965.pdfIn PDF document text
    • http://henca.com/files/details/file/xebesojijuzuvudem.pdfIn PDF document text
    • https://spherule.org/wp-content/plugins/super-forms/uploads/php/files/70b95f221e801c3977b73c266bbe6433/dotivosobagirebevudavav.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/FevRqgeaUVY/uplcv?utm_term=what+is+the+message+of+richard+coryPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0E0 10880 bytes
SHA-256: e5934a2c0ef2315b8b2581c5a9b77bf68c3e91820b5fb3a46da6db70fcbcf0d7
font_01_sfnt_off000109e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109E7 17100 bytes
SHA-256: 8674b3a54c4d16653dc83aa49ea8b7a4f0e1cbd9a3b9aeabff40f88d9ceb6d76
font_02_sfnt_off00013683.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13683 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.