Malicious PDF — malware analysis report

Static analysis result for SHA-256 685b065becbda97b…

MALICIOUS

PDF

72.2 KB Created: 2021-06-12 05:51:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ca9a2e73e882cde9d9da444ea3579359 SHA-1: f2b5fdb4e949639a4e51aa898686db4c40787433 SHA-256: 685b065becbda97b4aecfed6e4d6adde230aa650490c842d1c2d310804c7b5f0
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier. It contains a link farm pointing to multiple compromised WordPress sites, likely intended to host and distribute malicious payloads. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a tactic of using disposable hosting for these links, and the presence of 'utm_term' parameters suggests a phishing or scam-related lure. No scripts were extracted, but the overall structure suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7642

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/uplcv?utm_term=stick+pool+real+money+apk
    • https://newat.ru/wp-content/plugins/super-forms/uploads/php/files/68e2d140aed11908168e81b5dc3e007d/89091604850.pdf
    • https://kodeac.com/wp-content/plugins/super-forms/uploads/php/files/9r50sv7452ljp5gkumaci75ss8/24346444416.pdf
    • https://ckd-otto.com/contents//files/kujitaz.pdf
    • https://ballestermultiservicios.com/wp-content/plugins/formcraft/file-upload/server/content/files/160706b5623707---mumapifaposogigidinaro.pdf
    • http://ttlh.vn/storage/ckfinder/files/1224560950.pdf
    • http://verkoop-je-wagen.be/wp-content/plugins/formcraft/file-upload/server/content/files/160ab97e952d5a---jejaviwirezuvif.pdf
    • https://pinotcar.com/wp-content/plugins/super-forms/uploads/php/files/63e29c65f408b3fcb70ac5e43da13d89/ruwapidifumifujajisuj.pdf
    • http://www.tecnobor.com/ckfinder/userfiles/files/rezokivorevelugepisi.pdf
    • https://afd.me.uk/wp-content/plugins/super-forms/uploads/php/files/ln2h69b17ki9pfrpflpvvpk0m0/53768748467.pdf
    • https://www.18fire.com/wp-content/plugins/super-forms/uploads/php/files/4870e03d7589a466f3bfcdcdb6c20348/jopesinarawotoseli.pdf
    • http://baraanduliaptti.org/userfiles/file/55645231392.pdf
    • http://www.highlandmetals.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1606f050c01d5e---52176901902.pdf
    • https://gbeequestriansurfaces.com/wp-content/plugins/super-forms/uploads/php/files/0gfpbi1ddamojo4na7cacvfofb/71729847524.pdf
    • https://an-professional.ru/img/files/file/jijifidesuv.pdf
    • https://www.simplythebestevents.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160884a040af5c---2619489396.pdf
    • https://lecapsuledigian.it/file/59113982115.pdf
    • http://adanateknikservis.web.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16088d2112def7---wedajujixopukova.pdf
    • https://hosvagyok.hu/userfiles/file/84774254364.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e895.bin
9c5beade9000c88e4c0441a44a435bd6c5150c0f490225e8d854b3f386f8bbf9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE895 5172 bytes
font_01_sfnt_off0000fa29.bin
40181b246ea2d4c0ab4091548914f46e75428e39e2587595c3b5f426d8b67409		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA29 10980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.