Malicious PDF — malware analysis report

Static analysis result for SHA-256 44868521d34d1ddd…

MALICIOUS

PDF

58.6 KB Created: 2021-09-27 01:12:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-02
MD5: 2272b993a672b08530b5526eeee1331b SHA-1: 7e267f4bfd29c9a0a9c7c8828030b585febd626e SHA-256: 44868521d34d1dddd0d8db8b486fde75970059e56218c73f7208d756ea80a17f
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs pointing to external websites, many of which are hosted on disposable domains or compromised CMS uploads. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a pattern of using such PDFs for link farming. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent, likely to lure users into clicking malicious links, which is characteristic of phishing attacks delivered via email attachments.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6508

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://coretry.ru/uplcv?utm_term=country+with+longest+coastline PDF link annotation
    • http://studiotecnicolari.it/userfiles/files/bedabinarifanilepimoro.pdfIn PDF document text
    • http://vipacademy.org/userfiles/file/bugudodi.pdfIn PDF document text
    • http://michael-dhom.com/webseiten/file/burujifujorowajeki.pdfIn PDF document text
    • http://5e10.com/file/libugiwunoze.pdfIn PDF document text
    • https://burlingame.com/wysiwygfiles/file/genajilufononuvuda.pdfIn PDF document text
    • http://ipcmanpower.com/admin/style/images/userfiles/file/tetopeludubawutobu.pdfIn PDF document text
    • https://marciasmithconsulting.com/wp-content/plugins/super-forms/uploads/php/files/c54e685981e67e574cf884de305acfd4/gofonuludelitipupewega.pdfIn PDF document text
    • http://merklink.nl/site/data/ws/files/29485428834.pdfIn PDF document text
    • https://ginecologmuresan.ro/ckfinder/userfiles/files/3347313363.pdfIn PDF document text
    • https://relaxbotanika.cz/ckfinder/userfiles/files/vawaxi.pdfIn PDF document text
    • http://mudrkanuch.sk/editor_uploads/system/files/33421908820.pdfIn PDF document text
    • http://cmtdental.com/upload/ckimg/files/71727944113.pdfIn PDF document text
    • https://leresto-niort.fr/images/userfiles/files/66173895655.pdfIn PDF document text
    • http://thuephotocopytaihanoi.com/upload/files/zupaboxopoziferejawuderir.pdfIn PDF document text
    • https://kocarbonag.com/luutru/files/95135395819.pdfIn PDF document text
    • https://mimpishio2.net/contents/files/wiluwiga.pdfIn PDF document text
    • http://sun-green.nl/ckfinder/userfiles/files/dakagodufasidanuwowutedi.pdfIn PDF document text
    • http://novaserv.com/wp-content/plugins/formcraft/file-upload/server/content/files/161300b40dd4ce---21900707684.pdfIn PDF document text
    • http://lutechmed.com/Images_upload/files/dunuzagisokixatudifev.pdfIn PDF document text
    • https://vipbeachhouse.com/uploads/editor/file/ninevivoneramoxota.pdfIn PDF document text
    • http://vcelari.naceradec.cz/includes/ckfinder/userfiles/files/wimajodudonadoker.pdfIn PDF document text
    • http://eros-arena.name/eros/userfiles/file/demevalisejanide.pdfIn PDF document text
    • http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/66fsp9k4e5dt1hb2i5jq1ljgt6/87757265545.pdfIn PDF document text
    • http://maysoi.com/hinhanh_fckeditor/file/xajuvedikob.pdfIn PDF document text
    • http://mannaz.pl/userfiles1/file/gexidiwupobivojediserux.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b31a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB31A 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000cb31.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCB31 10840 bytes
SHA-256: 3165bb9a4898768c094b00c32e26ad1d5b8ebd756d60b3583a48171f7df62ce0

Open this report in the interactive analyzer, or submit your own file for analysis.