Malicious PDF — malware analysis report

Static analysis result for SHA-256 58ae0457266636c6…

MALICIOUS

PDF

80.1 KB Created: 2021-07-14 01:17:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 676d6a79efc540bb749f8000ddca6c3a SHA-1: ea6ebb7420c9504fef5c7c227cb42be9e807a945 SHA-256: 58ae0457266636c6d14548380712975844b6386563f77392e2676b251a9e6cdc
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains numerous external URIs and links to compromised WordPress upload storage, suggesting it is part of a link farm designed to redirect users to malicious sites. The presence of embedded URLs and the nature of the heuristics indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9952

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/uplcv?utm_term=unforgettable+french+montana+mp3+download PDF link annotation
    • https://www.yoursurveysurveyors.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160985d8d39f01---vutoxujilezejalewon.pdfIn PDF document text
    • http://childconnect.com/swi/fckfiles//file/geniwutavuzanawuzadusuv.pdfIn PDF document text
    • https://oklogistic.lv/upload/file/boguvitokem.pdfIn PDF document text
    • http://sosnovgeo.ru/userfiles/file/68499531668.pdfIn PDF document text
    • https://muacash.com/webroot/img/files/wamizajiludu.pdfIn PDF document text
    • https://www.adilaltinsoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d6b733ff36---79349018195.pdfIn PDF document text
    • https://laihouston.com/wp-content/plugins/super-forms/uploads/php/files/4caf6fc32635b1a1602c9d4caf51cedf/sejozulolol.pdfIn PDF document text
    • https://auto826.com/uploads/files/59339711931.pdfIn PDF document text
    • https://acrgroup.nl/userfiles/file/21967084438.pdfIn PDF document text
    • http://thunderstar.cn/userfiles/file/20210430211026102061458.pdfIn PDF document text
    • http://www.rlktechniek.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16073402fae5f6---38792395294.pdfIn PDF document text
    • https://autoschiller.de/wp-content/plugins/formcraft/file-upload/server/content/files/16079a6ceda2af---bulizopiwegisevitareke.pdfIn PDF document text
    • https://benchmarktransitions.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086e1a202240---60843204972.pdfIn PDF document text
    • http://www.telsercom.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f756643108---9652096894.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab9bf38b911---febaro.pdfIn PDF document text
    • http://noospc.ru/SITE/files/editor/file/76187413938.pdfIn PDF document text
    • http://colorfulmedia.de/fotki/fotki/file/rumumatavoxibuzosuf.pdfIn PDF document text
    • https://www.beewellrx.com/wp-content/plugins/super-forms/uploads/php/files/tmp/fuvusodajanukib.pdfIn PDF document text
    • http://munsusa.org/userfiles/file/20210526171958.pdfIn PDF document text
    • https://betibg.eu/webroot/img/files/dipixoma.pdfIn PDF document text
    • https://okinawa4d.com/contents//files/latemiwolebusopiwe.pdfIn PDF document text
    • https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/gq47dlalm3uon07arr6mu1blis/nebobofago.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b673.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB673 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000ce84.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCE84 18776 bytes
SHA-256: 3ded9aaca2ef9e6c6e95cee9882111b9cda0db582afcb602817e0619031ab472
font_02_sfnt_off0000ec6f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC6F 11212 bytes
SHA-256: e7b2f32930c3bd8f563f684fb4835af9357115d016b194ea075964857aa04173
font_03_sfnt_off0001062b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1062B 16436 bytes
SHA-256: 726a6e8b58a6fe13e18af1448988bc3d0dfe122471e8bf71b24237323b235ca6

Open this report in the interactive analyzer, or submit your own file for analysis.