Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b1d9333c1846e96…

MALICIOUS

PDF

63.6 KB Created: 2021-06-10 16:38:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: 236713fad65659da1510dec35276fc72 SHA-1: b41da5fd01ecc1cb8636f70850e289227ab1a17e SHA-256: 4b1d9333c1846e968520dbc1bf7b05ab3445059dcc1c80385da81d41a5a548ab
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains multiple links to external websites, many of which are hosted on compromised WordPress sites. The document body suggests a lure for downloading a movie, which is a common tactic for phishing or malware distribution. The presence of numerous links and the ML classifier's high confidence score indicate a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8599

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/uplcv?utm_term=descargar+el+diario+de+bridget+jones+2+por+utorrent PDF link annotation
    • http://hattrick-sports.com/wp-content/plugins/formcraft/file-upload/server/content/files/160851edd548d2---biladukaninuzaxeg.pdfIn PDF document text
    • http://bhk-aindling.com/userfiles/files/35533036160.pdfIn PDF document text
    • https://fieldofgreen.com/wp-content/plugins/super-forms/uploads/php/files/ed482ed7a4e2b8242e12985445b76b65/sevuk.pdfIn PDF document text
    • http://www.adatechotomasyon.net/wp-content/plugins/formcraft/file-upload/server/content/files/160a11cdd7d670---bubudulirap.pdfIn PDF document text
    • http://cioccolatogallucci.it/userfiles/file/9817720112.pdfIn PDF document text
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/6b0654ahkq0le1gjlh1c9l3mu0/rosufafolefemewupod.pdfIn PDF document text
    • https://realestateconnect.us/wp-content/plugins/super-forms/uploads/php/files/nq0m9rbtkj9jl733004qosuls3/telibijosisegis.pdfIn PDF document text
    • http://maychamsocda.vn/images/userfiles/file/kozadolatatuda.pdfIn PDF document text
    • https://nscs.org/wp-content/plugins/super-forms/uploads/php/files/f0dec296945e2f8e203cc8212adaf9aa/nuvomibuwotebutikusasiju.pdfIn PDF document text
    • http://www.nationaalgolfcongres.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16078cc27d170e---56436026590.pdfIn PDF document text
    • https://atlasautoglass.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607398d6c9d61---bafevupogulidir.pdfIn PDF document text
    • http://mko-yug.ru/wp-content/plugins/super-forms/uploads/php/files/241f87b007d0653b905b52138b1cc91f/nitajixamutataj.pdfIn PDF document text
    • https://amenajarisiconstructii.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607a80e4349ce---43100754639.pdfIn PDF document text
    • https://taechoclub.com/FileData/ckfinder/files/20210605_5291480175D120BE.pdfIn PDF document text
    • http://beateromer.com/bilder/file/61534978404.pdfIn PDF document text
    • http://wannawwannie.pl/userfiles/file/vukuxazazem.pdfIn PDF document text
    • https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/c367a05ac6fac42b54256249cf3760c5/gagupapapisewudedanewu.pdfIn PDF document text
    • https://bachson.net/upload/file/5567752386.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ead2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAD2 5588 bytes
SHA-256: ffde8caad765a457f53f57fc7f50875800e1571cf115976741d826e7fdd775ef

Open this report in the interactive analyzer, or submit your own file for analysis.