Malicious PDF — malware analysis report

Static analysis result for SHA-256 738b41b3cd440f6b…

MALICIOUS

PDF

76.4 KB Created: 2021-06-06 15:14:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3c9458529e616290e707abd87baf3c4b SHA-1: ab660cee066bec3d441fb98415b16a4e0770c189 SHA-256: 738b41b3cd440f6be0545719d0aab80f70658aef7105cb5ea4971f107cec824a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external URLs, many pointing to compromised WordPress sites, suggesting it functions as a link farm or redirection mechanism to potentially malicious content. The presence of PDF-specific heuristics like 'PDF_SEO_DISPOSABLE_LINK_FARM' further supports this, indicating the PDF's primary purpose is to drive traffic to these external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8117

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garglob.ru/uplcv?utm_term=the+berkeley+review+mcat+books+2019
    • https://amiablediamonds.com/wp-content/plugins/super-forms/uploads/php/files/b290b89a02f3dc3a4ae590b1c5453ecc/27427257478.pdf
    • https://thepetrichortouch.com/wp-content/plugins/super-forms/uploads/php/files/2idn295dvftr7fb1o3211rj4fn/21648077591.pdf
    • https://www.criteriainvest.com.br/wp-content/plugins/super-forms/uploads/php/files/43la30188ho7eo5ujfta0afsou/19787385196.pdf
    • https://www.ideaklinikkadikoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f16e8ecb0b---dakamokanojiwakodo.pdf
    • https://vakukh.ru/wp-content/plugins/super-forms/uploads/php/files/bb87a5f138f105d570ee495ce3946380/46309805877.pdf
    • http://wasserburg.pl/userfiles/file/26731037839.pdf
    • https://ka-base.no/images_content/file/60071226645.pdf
    • https://inchiriereelicoptere.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160b5e5791e17f---87325348040.pdf
    • http://phenix-security.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16077f6ea18f91---dedizusegoguwavo.pdf
    • https://sg-design.top/wp-content/plugins/super-forms/uploads/php/files/224a128a9d12600fc408ed38918d59a5/7283657792.pdf
    • http://geyikkimya.com/userfiles/upload/file/69271780813.pdf
    • http://altaprecision.com/userfiles/file/tonogogifafija.pdf
    • http://aeskulap24h.de/wp-content/plugins/formcraft/file-upload/server/content/files/1609833482d1a2---1968853838.pdf
    • https://valserve.in/web/k/main_admin/ckfinder/userfiles/files/sizedole.pdf
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160847cd5157f2---gopuworuduxos.pdf
    • https://saftanton.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160b54a31ba230---tovasadujaxerude.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1c6.bin
dd02758cf796db1fab5124f6585575d8adbde0f4b2c948f3a045c93e127b8276		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1C6 5608 bytes
font_01_sfnt_off000104eb.bin
7dd84cbd4b863916cc02b4e205fca8c81f3cf178362582998f8e929e7d07dcd1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104EB 11128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.