Malicious PDF — malware analysis report

Static analysis result for SHA-256 439f14bcbaaf34c9…

MALICIOUS

PDF

69.4 KB Created: 2021-06-17 19:51:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c93ace9c5a821f17cfdf07f442b5f6f5 SHA-1: 60dd4b1822a2e7be5e2ee369fa7c6be673254bd0 SHA-256: 439f14bcbaaf34c90c3f04d94848e4c1922c31359b6ef1ec85a86722f6258049
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm pointing to multiple compromised websites, likely to trick users into downloading a game. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8470

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jaunimodienos.lt/wp-content/plugins/super-forms/uploads/php/files/lmojoiq9fafkr94qmdr92pvmiq/50915912904.pdf
    • https://worldkelo.com/wp-content/plugins/super-forms/uploads/php/files/35387a00b15e4ba3d4be3504c477cac1/juwilutox.pdf
    • https://lightsourceindiana.com/wp-content/plugins/super-forms/uploads/php/files/a9857217835894099addec929547cbde/vozotudi.pdf
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071cb966294a---xoxasunobe.pdf
    • https://chauphongasia.com/wp-content/plugins/super-forms/uploads/php/files/a3ngqdvem0bmth7rl0nmhjtnmt/47775698307.pdf
    • https://123kozijnofferte.nl/wp-content/plugins/super-forms/uploads/php/files/gv214uq2l0e8h8i0iddfr0k895/xanuxupovudupov.pdf
    • http://lateonsettay-sachs.org/userfiles/file/63518827410.pdf
    • http://kwik-it.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160801b7bb25f3---disitokinetabulomibeb.pdf
    • https://www.enterpriselighting.com/wp-content/plugins/super-forms/uploads/php/files/915c44e4ba93a5cd0a81c893d6810db1/bomosowoz.pdf
    • http://alkanboya.com/files/file/%5C/27063979438.pdf
    • https://srp-galabau-rostock.de/wp-content/plugins/super-forms/uploads/php/files/6lpd60hof7v0l0edp5j558kvpg/tizogi.pdf
    • http://careerhack.net/wp-content/plugins/formcraft/file-upload/server/content/files/160957a58935b8---bedinumalalaba.pdf
    • https://amatnieks.lv/pictures/image/38915581673.pdf
    • http://www.altrus.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1608a29b060d21---nexowimagefisuwibakadenu.pdf
    • http://nuestratierrapremios.com/campannas/file/zerukunovufamenezatenid.pdf
    • http://hjtech.org/admin/upfile/file/96576403368.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/A3Ryygt5BCM/uplcv?utm_term=age+of+empires+2+rise+of+the+rajas+download
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e146.bin
ce9415ff16eac6d4811ee2e27774788b007ec40a77ffcb5e0191efa718cc386b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE146 5744 bytes
font_01_sfnt_off0000f4c4.bin
7e04c55ccea8d1efd69ff21a93d24c76ee10b2c4b2aade17986c0c24cc6c1b0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4C4 11452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.