Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e0eef0c1f184268…

MALICIOUS

PDF

64.0 KB Created: 2021-05-06 04:12:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bddc46f88d9cc3d5d6e46500bbf4bd04 SHA-1: dc4ce1ac3b01b2bfea6bf252936d411f19c08c5f SHA-256: 7e0eef0c1f184268e719e2fa7bc8f33361c99ef7b23172a0be0a2f87ce40fee9
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and ML classifiers, indicating a high likelihood of malicious intent. It contains numerous links, many pointing to compromised WordPress sites, suggesting it functions as a link farm to distribute malicious content or phish users. The embedded URLs and the nature of the links strongly suggest a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9776

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garglob.ru/uplcv?utm_term=answering+your+partner%2527+s+questions
    • https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/160886dd4569e4---kagotosuwepokonixirul.pdf
    • http://www.northeastmarquees.com/wp-content/plugins/super-forms/uploads/php/files/bb5f335fc2ef8cd5c4c2d4280d96a80f/76234309065.pdf
    • http://www.hotel-margherita.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c9432a891b---64404035685.pdf
    • http://altelaw.com/uploads/image/file/49247983496.pdf
    • https://unique.global/wp-content/plugins/super-forms/uploads/php/files/56650b73a1ed803beac63ad93b3202e9/jipexezirilarasat.pdf
    • https://harvestrain.com/wp-content/plugins/super-forms/uploads/php/files/5dfcc808d4f93ddeba562e0320c5a547/21122909290.pdf
    • http://afgventuregroup.com/cfiles/file/zezelid.pdf
    • https://www.colegiodesafio.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/1607a57b14b1e9---pudujibirufuba.pdf
    • https://championsforchildren.org/wp-content/plugins/super-forms/uploads/php/files/0bc6c56c8595baab4aae05ce357d583e/39784449055.pdf
    • http://theydeserveastamp.org/wp-content/plugins/formcraft/file-upload/server/content/files/1608365cd14944---34721247330.pdf
    • http://agcslohian.com/userfiles/file/wotajimizagefuwunivip.pdf
    • https://southtours.com/wp-content/plugins/super-forms/uploads/php/files/egf4bip6r6resqqn1sshos1i0f/82319391117.pdf
    • http://www.drop-lok.com/wp-content/plugins/formcraft/file-upload/server/content/files/160781e8615939---77114831165.pdf
    • https://polskieplytki.com/wp-content/plugins/super-forms/uploads/php/files/555fab1dab9f8669d794225edf696a33/situpugaxamu.pdf
    • https://afd.me.uk/wp-content/plugins/super-forms/uploads/php/files/avf7nf2k0gbiahdcrt187k4fh8/34560349110.pdf
    • http://www.dj-csnl.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608b21164f006---27058136398.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d868.bin
18f40f6fa0c5b660c65c9ec7f452e423a8910e33f0330b6a6f9edd42f98dcc9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD868 5296 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.