Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e379726a6823d7d…

MALICIOUS

PDF

74.8 KB Created: 2021-06-13 04:55:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: ecf25e7292810fa4f9f9fadf41a1acc7 SHA-1: 55cc58e51865c98fa134f7e38f94d622b1532ef5 SHA-256: 6e379726a6823d7dbbd7571746bc7422be0f35ee5e1f0d74a688d0b180854a7d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains numerous links pointing to compromised WordPress sites and other disposable hosting, indicating a link farm designed to distribute malicious content. The ClamAV detection and ML classifier strongly suggest this PDF is malicious, likely serving as a lure for phishing or malware delivery. The embedded URLs and the nature of the heuristics point towards an attempt to exploit users through deceptive links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9282

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/uplcv?utm_term=pst+jst+jobs+in+sindh+2021+online+form PDF link annotation
    • https://seataclightingalaska.com/wp-content/plugins/super-forms/uploads/php/files/d0c1e7c39331c908d9f9fc297e928b91/ziwuvezoraxedewi.pdfIn PDF document text
    • http://mijneigenlift.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16079ca68cedba---katapetevujigo.pdfIn PDF document text
    • http://kengosushionlineorder.com/uploads/files/lumuvapunimofuk.pdfIn PDF document text
    • https://unosms.us/userfiles/file/gidogoriw.pdfIn PDF document text
    • https://www.accidentinjurylascruces.com/wp-content/plugins/super-forms/uploads/php/files/tedv1pcbvsmuat26jv2btqmm4c/97300088295.pdfIn PDF document text
    • http://hodori247.com/uploads/files/zazezirenomuwasuki.pdfIn PDF document text
    • https://www.marvistasales.com/wp-content/plugins/super-forms/uploads/php/files/902da023037b60145e3c8c76e8a64638/naxewegezagawanemaduxag.pdfIn PDF document text
    • https://www.rekalibracija.com/wp-content/plugins/super-forms/uploads/php/files/0b1eb37b5382678fd3709c13bc410a62/6544747395.pdfIn PDF document text
    • http://cgt-fo-csc.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160c46a1ff3bfd---11740532136.pdfIn PDF document text
    • https://www.lipfish.no/wp-content/plugins/formcraft/file-upload/server/content/files/1606ff2fb20c76---9069649654.pdfIn PDF document text
    • https://www.albispanaderia.com/wp-content/plugins/super-forms/uploads/php/files/674285247017b3802318e5d2cda26766/59709557024.pdfIn PDF document text
    • http://feng-shuiworld.com/userfiles/file/ravigi.pdfIn PDF document text
    • https://astoriareiki.com/wp-content/plugins/super-forms/uploads/php/files/b94435f4f51690e5c0bf5375cbcbecd9/virikav.pdfIn PDF document text
    • https://avis-medical.ma/wp-content/plugins/super-forms/uploads/php/files/d552bb5faf5560592feb00b9af3f7de5/vexikopet.pdfIn PDF document text
    • https://xn--80aaaglcftt5alesfkk7f.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/69ce7c40e3f9656219389dc118561c50/69380913826.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7A9 5480 bytes
SHA-256: 6367d3d309b42fe5227f1ee08678827c7aef6b759d857ece012c26b230e59a66
font_01_sfnt_off00010a2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A2E 11756 bytes
SHA-256: 0812982e07c647b88488f4e16f5643d244e5c5dbe908fa725a75336bd82c826e

Open this report in the interactive analyzer, or submit your own file for analysis.