Malicious PDF — malware analysis report

Static analysis result for SHA-256 8164d1a3f4ee8d6b…

MALICIOUS

PDF

64.0 KB Created: 2021-06-12 22:59:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c82be12627d3d449252ea586ff92680c SHA-1: 5b17a4366c25646a999b85fbc037c14cf7c175e5 SHA-256: 8164d1a3f4ee8d6bdfb6fa000ff582afc39f211cc5264432f052918d6accc826
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links to external websites, many hosted on compromised WordPress installations or disposable domains, suggesting it functions as a link farm to distribute further malicious content or phishing lures. The document body, though heavily obfuscated, contains text related to "wkhtmltopdf" and a search query, reinforcing the idea that it is designed to trick users into visiting malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8987

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/uplcv?utm_term=excel+sheet+formula+bar+missing
    • http://merlegdoktor.hu/tmp/lekagez.pdf
    • http://www.asejnrtigers.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1607231f68c160---63114009439.pdf
    • https://kassa-evotor.ru/wp-content/plugins/super-forms/uploads/php/files/h2jtcrqg4991htvkdbrqu65ime/46544860108.pdf
    • http://www.nowsingapore.co.id/wp-content/plugins/formcraft/file-upload/server/content/files/16079d91622689---mesuregu.pdf
    • http://www.suffaheducation.com/wp-content/plugins/formcraft/file-upload/server/content/files/160723e542d7ed---mevugezosibabomegofafajep.pdf
    • http://bidmitt.com/img/files/file/burudaladoduzifulofo.pdf
    • http://maychamsocda.vn/images/userfiles/file/54771137866.pdf
    • http://www.hkwebdesign.com.hk/wp-content/plugins/formcraft/file-upload/server/content/files/16087225edfb8c---lolimunakafo.pdf
    • http://szpk.hu/_user/file/petovejumapufapoje.pdf
    • http://oneself.pro/wp-content/plugins/formcraft/file-upload/server/content/files/160a5b7a2c7794---33877302455.pdf
    • http://kondicionery-dolgoprudny.ru/upload_picture/file/25312090546.pdf
    • http://stinpo.com/ckfinder/userfiles/files/roretegesemur.pdf
    • http://www.klpreschool.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609fcc4201dff---48129366873.pdf
    • https://diversifiedhumansolutions.com/wp-content/plugins/super-forms/uploads/php/files/23bbfc57cdd62264efd61fdca60c5542/68463853292.pdf
    • http://www.optionassurance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160aa61711ac92---25271594217.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000edcc.bin
18a6866365352a5aaa859efd0119ffcb3701f9e002b96785cf8c168691df499e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDCC 5460 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.