Malicious PDF — malware analysis report

Static analysis result for SHA-256 73d64ed7e7c65a13…

MALICIOUS

PDF

69.3 KB Created: 2021-06-03 14:28:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: 27d957cf864267275975b0fc60de7999 SHA-1: d1b29c06c1e54aa9833db140f92b522f0fb27675 SHA-256: 73d64ed7e7c65a1346c008e6eaf0ed010fcf38a1bbdf937d8b656b08f54579af
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan payload. It functions as a link farm, with numerous embedded URLs pointing to compromised WordPress sites, likely serving as a distribution point for further malicious content. The document body is heavily obfuscated and contains metadata suggesting it was generated by wkhtmltopdf.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7687

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://sv-fin.ru/wp-content/plugins/super-forms/uploads/php/files/c728637a471404fcc47e8c90eca06741/59760147566.pdf In PDF document text
    • https://doitsolutions.co/wp-content/plugins/super-forms/uploads/php/files/7da3816072f7ffc512b82e9bf2588214/nexesazibotimutamebabiw.pdfIn PDF document text
    • https://englewoodgrassfarm.com/wp-content/plugins/super-forms/uploads/php/files/752a0191148691e1e0009a9a3784d429/66074320313.pdfIn PDF document text
    • https://www.18fire.com/wp-content/plugins/super-forms/uploads/php/files/d928cddb425df2f1fbb11811b3ce1476/mawofafabixut.pdfIn PDF document text
    • http://charivne.info/images/file/likanek.pdfIn PDF document text
    • https://www.justgym.co.za/wp-content/plugins/super-forms/uploads/php/files/c3fksj7aukop0187csf993ovqj/batizagozelugoded.pdfIn PDF document text
    • http://sarahscupcakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a5e67c8046f---xavajagofenoni.pdfIn PDF document text
    • http://milcontabil.com.br/wp-content/plugins/super-forms/uploads/php/files/dvkju8kd9gtoo8d2bec8sgscj6/37354233229.pdfIn PDF document text
    • https://www.temsilcifirsatlari.com/wp-content/plugins/formcraft/file-upload/server/content/files/160721f10c94db---740274718.pdfIn PDF document text
    • http://www.auditsi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b5b4593746e---pajixubipox.pdfIn PDF document text
    • https://jodhpurtravels.com/nbloom/fckuploads/file/45792813069.pdfIn PDF document text
    • https://www.criteriainvest.com.br/wp-content/plugins/super-forms/uploads/php/files/5ehmi66l4941dm51poheboaitr/38405418742.pdfIn PDF document text
    • http://www.assignproject.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ea65ea28d7---10600572982.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/cv9VXjIrmdE/uplcv?utm_term=testo+masoretico+italiano+pdfPDF link annotation
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e192.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE192 5248 bytes
SHA-256: 83ecc6d14b43da8b79871bc905e0b498316ff7e1059e075b123d81a8833b5881
font_01_sfnt_off0000f351.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF351 11816 bytes
SHA-256: b0c2a789d86cd9a2fc321153c4e9f093ba86ff860e15a0e963139ed18efa2373

Open this report in the interactive analyzer, or submit your own file for analysis.