Malicious PDF — malware analysis report

Static analysis result for SHA-256 633125c84fb722fa…

MALICIOUS

PDF

122.5 KB Created: 2021-06-25 00:18:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 4a39e77cbae6bf28e576536ad330b129 SHA-1: 6cccaee6cfddb573ac12e29c71e43b7d855db9da SHA-256: 633125c84fb722fa73a3e781844a90b59acd70dacb59798a302c1568e309afe9
204 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document is identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document impersonates the Chase brand and uses a lure related to 'Call of the wild red deer locations' to trick users into clicking a link. This link, `https://pistant.ru/uplcv?utm_term=call+of+the+wild+red+deer+locations`, leads to a compromised WordPress upload storage, suggesting a credential phishing attempt. The presence of numerous external URIs and link farms further supports the phishing attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 8

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://pistant.ru/uplcv?utm_term=call+of+the+wild+red+deer+locations.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pistant.ru/uplcv?utm_term=call+of+the+wild+red+deer+locations PDF link annotation
    • http://bociany.sk/media/file/jeboxitid.pdfIn PDF document text
    • http://arcenevents.nl/site/upload/files/naligapuvizivula.pdfIn PDF document text
    • http://sts-logistika.ru/wp-content/plugins/super-forms/uploads/php/files/5241a3839cebc565518a35af33b3c61b/muvubesobe.pdfIn PDF document text
    • http://sheeld.org/clients/d/d0/d021426cee8527c21a172be12ef3d645/File/57452542666.pdfIn PDF document text
    • http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f6aea0a5dd---nurexeril.pdfIn PDF document text
    • https://www.drserapkagan.com/wp-content/plugins/super-forms/uploads/php/files/gr2a44g5bo9902ig3a5klltj3q/gajonurimomewavuma.pdfIn PDF document text
    • http://trenermichal.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16070bd2727396---bofimomidu.pdfIn PDF document text
    • http://fantasypartyentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a3192e68c1e---siloxinosewafimox.pdfIn PDF document text
    • http://www.playerclub.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1609f81ca433d8---32866625889.pdfIn PDF document text
    • https://monacollection.ua/wp-content/plugins/super-forms/uploads/php/files/03d13457b6823d2edb4e4715427497da/42819949278.pdfIn PDF document text
    • https://hirurgija.me//files/tevimuz.pdfIn PDF document text
    • https://saam.vn/images/content/file/zotinevovin.pdfIn PDF document text
    • https://plumcourse.com/wp-content/plugins/super-forms/uploads/php/files/c7b372bf91a4fcd62118ca720d0a421d/24887552754.pdfIn PDF document text
    • https://ceadersvalet.com/wp-content/plugins/formcraft/file-upload/server/content/files/160766a7ae423d---nirenenilinimebazerulamot.pdfIn PDF document text
    • http://www.brennholz-heinlein.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606cdc3aef0ef---59556690071.pdfIn PDF document text
    • http://xn--80aafkqcanfpgnhbng3b5i9a.xn--p1ai/pict/file/78996745536.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a3da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A3DA 5108 bytes
SHA-256: beda18069eb0597e0735abf3e233829710d4d01f9f788834f485b30206578bf5
font_01_sfnt_off0001b53f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B53F 11080 bytes
SHA-256: 394cfa50560dc08c8774222a1619a9cc0855d24410d9c20ca1329478018abd83

Open this report in the interactive analyzer, or submit your own file for analysis.