Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e61423ed7f32217…

MALICIOUS

PDF

112.0 KB Created: 2021-05-11 20:28:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 90868a859dfd0a0623a577c0b5b92281 SHA-1: 5d27dcb8c4171577d8b0060d611428dbba99c9e8 SHA-256: 5e61423ed7f322175ee2d0cb02c22727ef2450bad81043787a4427811db0b5ec
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous links to external websites, many of which are hosted on compromised CMS platforms, suggesting a phishing or malware distribution campaign. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, contains references to 'birthday invitations templates psd' and 'wkhtmltopdf', aligning with the heuristic findings of a link farm designed to lure users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9076

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ketchas.ru/uplcv?utm_term=birthday+invitations+templates+psd
    • https://protechlighting.com/wp-content/plugins/super-forms/uploads/php/files/dd964b65deaadf158ef36739cf5e9585/17714296210.pdf
    • http://chocolatycakes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606caaba6603a---30057022591.pdf
    • https://alcc.vn/wp-content/plugins/super-forms/uploads/php/files/52qngkvepak8o5esiq3nr9i90f/mofoxe.pdf
    • https://bluebeakbranding.com/wp-content/plugins/super-forms/uploads/php/files/f1b3b0ecae2929756807952bc362bf78/94926263526.pdf
    • https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/1606cde0bc349f---6533577481.pdf
    • https://rrvchefs.com/wp-content/plugins/super-forms/uploads/php/files/ac326ffed2e10a513b4caad0d5841724/lobowekuvusubuniba.pdf
    • https://atlasautoglass.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d971869c1c---zefaxabi.pdf
    • http://www.pirac.org/wp-content/plugins/super-forms/uploads/php/files/fa41440fa28063be2b7525aa1dca32fe/39683699584.pdf
    • http://msci.com.ng/wp-content/plugins/formcraft/file-upload/server/content/files/160766b3ce04f6---marabesu.pdf
    • http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/t3gvdr05ut77vgqkr0nqg38423/xeduwapazifirigaro.pdf
    • https://www.keystonecare.co.uk/wp-content/plugins/super-forms/uploads/php/files/880467c6cd516504bb250e4496ab37ab/mezofunuxokasesakop.pdf
    • http://sh8ke.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607087d471b6e---tinobibepoj.pdf
    • https://beachesbrewing.com/wp-content/plugins/super-forms/uploads/php/files/25791a2dbc49145f5ba6d6de331b7732/92349085255.pdf
    • https://afayl.com/userfiles/file/wawidunurali.pdf
    • http://bjoybrands.com/wp-content/plugins/formcraft/file-upload/server/content/files/16095c5f1f29ba---disaxuniwulotoxa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000152a1.bin
127b44c9f93874c96d25eb7ddc4688780d8877ce931cf296363fb5748d8d514b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x152A1 6744 bytes
font_01_sfnt_off00016358.bin
4785377568ca9917acc0666162df65a6d74386777202c8beeeed97bb5cc8873a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16358 11168 bytes
font_02_sfnt_off000188b9.bin
67c2b36be792420d1400a1af8907f61e108fab2d949c410c7444de7a1caaf607		 pdf-font-stream PDF embedded font (sfnt) at offset 0x188B9 5412 bytes
font_03_sfnt_off00019b00.bin
a5c9abaa1a6fa8524eee8dc0212b064cd2adf5644143773069b7e6c96d9ce106		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19B00 14084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.