Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ec707b8d2742bcd…

MALICIOUS

PDF

90.6 KB Created: 2021-06-25 20:12:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: bf58c44ff3376fac70190181dd54ae13 SHA-1: 16884d0d88fcc1a39f0529a792582ce373c198f9 SHA-256: 6ec707b8d2742bcd2c98efed6c6413118c8dc640573ddd66e178ae7218268453
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by ClamAV as a phishing trojan and by an ML classifier with high confidence. It contains numerous links pointing to compromised WordPress sites and other disposable hosting, suggesting a link farm designed to redirect users to malicious content. The presence of embedded URIs and the nature of the heuristics indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9948

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://huntic.ru/uplcv?utm_term=compare+contrast+essay+outline+template PDF link annotation
    • http://www.sarajevo-inn-grunewald.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c600c16e06---nunukabu.pdfIn PDF document text
    • https://sckprime.com/wp-content/plugins/super-forms/uploads/php/files/66cec69ce1ff43d8da52919b77fe2da1/duwoxizope.pdfIn PDF document text
    • https://agrotehholding.ru/wp-content/plugins/super-forms/uploads/php/files/8c407a913a546c86e28d9759b59bf293/68802669896.pdfIn PDF document text
    • http://127.0.0.1/kardelenemlak/upload/files/sorodezofarimatodutiwi.pdfPDF link annotation
    • http://terapeutickemasaze.eu/wp-content/plugins/formcraft/file-upload/server/content/files/1608c621bcbab0---66296473616.pdfIn PDF document text
    • https://quickonboarding.com/wp-content/plugins/super-forms/uploads/php/files/a65fe414c9078b18fa312b8a348871a4/68746591856.pdfIn PDF document text
    • http://clearlakesd.org/wp-content/plugins/formcraft/file-upload/server/content/files/160bede7054375---wapilosofutefol.pdfIn PDF document text
    • http://shinserviceodi.ru/wp-content/plugins/super-forms/uploads/php/files/ba1be53b99f94ccccb8b2293916408da/61238093230.pdfIn PDF document text
    • https://t4g.nasscomfoundation.org/wp-content/plugins/super-forms/uploads/php/files/g0k44igihbqitbifkpj5gp1ic0/xaxotab.pdfIn PDF document text
    • https://centrosteadycam.it/wp-content/plugins/super-forms/uploads/php/files/6b574001f953da2a2f9b8ad444057653/294470022.pdfIn PDF document text
    • https://www.lindopoint.it/wp-content/plugins/super-forms/uploads/php/files/bea2a96fc9879ebe0179bab2f73569b8/guxawabopirarisafedijurex.pdfIn PDF document text
    • https://genericdiabeticteststrips.com/userfiles/files/ribazufolaxalaxuraz.pdfIn PDF document text
    • https://medtek.vn/storage/file/17988952540.pdfIn PDF document text
    • https://thealloywheelcentre.co.uk/wp-content/plugins/super-forms/uploads/php/files/d2a8ea5a040323097803a792534437ea/lemapujiborujuzemumone.pdfIn PDF document text
    • https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/1608edfece6ca4---59106954444.pdfIn PDF document text
    • https://jaunimodienos.lt/wp-content/plugins/super-forms/uploads/php/files/j8nni8b0svilfmnoahj4lo7mqi/pesutopif.pdfIn PDF document text
    • http://brighterhealthcare.co.uk/wp-content/plugins/super-forms/uploads/php/files/ef6dm0f1v432i9cibrf3v8h2qn/jibawotokared.pdfIn PDF document text
    • https://glass-haus.ru/wp-content/plugins/super-forms/uploads/php/files/a0f67624b8f10eeb177e6cfe2c41300c/vubedupopodiwoxokavuvek.pdfIn PDF document text
    • http://ersatzmonitor.de/userfiles/file/82111474621.pdfIn PDF document text
    • http://drvision.org/wp-content/plugins/formcraft/file-upload/server/content/files/1609e07664741d---pejomozupinakon.pdfIn PDF document text
    • https://homini.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160b589a18a83f---21115022227.pdfIn PDF document text
    • https://rhdplumbing.com/wp-content/plugins/super-forms/uploads/php/files/c9fba7d532e2116f4aa56d5b9aa95a71/62214571546.pdfIn PDF document text
    • http://www.immiflex.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d8e0ae6855---95892670920.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fffb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFFFB 10780 bytes
SHA-256: e148b6532f72d520aea4c4a2b5cbe1f88abd226f448ec9ffdfba45a0d4dcaa8d
font_01_sfnt_off000118d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118D0 17208 bytes
SHA-256: 9065df2f6cf96ddb88f8a9fe18ae12c21accdecab91f60eb476818ba1f142593
font_02_sfnt_off00014509.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14509 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.