Malicious PDF — malware analysis report

Static analysis result for SHA-256 7beea48528a42f3b…

MALICIOUS

PDF

86.5 KB Created: 2021-06-28 22:12:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24
MD5: 25af6c1c3ef285d721b53bc5e9df9390 SHA-1: 379d61138a05ec381f24fba3845a546ce89b5482 SHA-256: 7beea48528a42f3b0b4dbc01ceeff578466a4cdf82cf24937135a5f97caa704f
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link farm with numerous URLs, many pointing to compromised CMS upload directories. ClamAV detected this file as a phishing trojan. The presence of multiple links on disposable or compromised hosting suggests an attempt to lure users to malicious sites for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier clean score 0.1300

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://co-wemart.com/careeruserfiles/file/badutapabovagilidanesa.pdf In PDF document text
    • http://www.verneteco.com/ckfinder/userfiles/files/muwibuw.pdfIn PDF document text
    • http://timebank.ru/sites/default/files/photos/pagefile/25318630363.pdfIn PDF document text
    • http://xn----8sbpvg0afdbe.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/idk9gm020j26r6m6n5ggi26r02/wuguno.pdfIn PDF document text
    • http://szwygs.com/upload/zadidodufa.pdfIn PDF document text
    • http://atut-biuro.com/uploaded/file/sekisunalevopilumika.pdfIn PDF document text
    • https://choiceenergynetwork.com/wp-content/plugins/super-forms/uploads/php/files/21f83a1d040a6ba944d2e85fb6f39468/nevotebapazamuwunu.pdfIn PDF document text
    • https://zanhotel.ro/beficientconsultingFiles/file/pagusomibujem.pdfIn PDF document text
    • https://tkpmission.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a6625758b9f---wodifa.pdfIn PDF document text
    • http://www.miamiairportlimo.net/wp-content/plugins/formcraft/file-upload/server/content/files/1609e64e758996---milolegupubavakuwaj.pdfIn PDF document text
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/ffsnk2qbecvk5f79t607ornfl7/94277755726.pdfIn PDF document text
    • http://emirates-offshore.com/uploads/image/file/33997081638.pdfIn PDF document text
    • http://abwplazaview.com/uploads/files/xajagiz.pdfIn PDF document text
    • https://mziagroup.com/wp-content/plugins/super-forms/uploads/php/files/91ho37lcr8unns56pe25bo9cio/xovipofupa.pdfIn PDF document text
    • http://socialbomjesus.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160cdb2252e706---15727147746.pdfIn PDF document text
    • https://www.mercato.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1609fa7fe875a3---24995230254.pdfIn PDF document text
    • https://boldvision.tv/wp-content/plugins/formcraft/file-upload/server/content/files/1608fb0218c8d8---bapamag.pdfIn PDF document text
    • https://bursakaynak.com/userfiles/file/13745946235.pdfIn PDF document text
    • http://makaifruits.com/wp-content/plugins/formcraft/file-upload/server/content/files/16095f113cccc2---wigafopotigik.pdfIn PDF document text
    • http://barudan.hk/UploadFile/file/20210530043739647.pdfIn PDF document text
    • https://unicornproduction.gr/wp-content/plugins/super-forms/uploads/php/files/fa0fb824538578ec0b35989d3b24cd55/6189974537.pdfIn PDF document text
    • http://www.driftime.ee/wp-content/plugins/formcraft/file-upload/server/content/files/160c301e9ed044---409284632.pdfIn PDF document text
    • https://creationstationdance.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077c75e04c53---34576045480.pdfIn PDF document text
    • http://sistersaviopublicschool.com/userfiles/file/lamapesejusewaliv.pdfIn PDF document text
    • https://claphamjunction.com.au/wp-content/plugins/super-forms/uploads/php/files/cab9143f758d33ff34b15f048dfa95e4/sodemebenotudanagin.pdfIn PDF document text
    • http://gyobel.it/public/file/43970388181.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1KS0DP0cxss/uplcv?utm_term=white+house+oval+officePDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb6a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB6A 10388 bytes
SHA-256: 96ecaab30eb0e1a1d71a9b3c6001cb891e0a1d880a5f416eca100c13bf4ef699
font_01_sfnt_off00011324.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11324 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00012b36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12B36 17524 bytes
SHA-256: 054822b45729148dbcd6d15a665327a9bef70954ebfd8e62b215d2f86793a233

Open this report in the interactive analyzer, or submit your own file for analysis.