Malicious PDF — malware analysis report

Static analysis result for SHA-256 862ed79314bdbba0…

MALICIOUS

PDF

74.8 KB Created: 2021-06-17 09:12:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2914f9280da7b934ac70fa5775582865 SHA-1: e0674477566c798dbae54179b616915d6f4f7b56 SHA-256: 862ed79314bdbba0e449137baf5f6ab0aeb11eb00b2c6a4fdcb9105451d6f186
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. It contains numerous links to compromised websites and disposable hosting, suggesting it's part of a link farm designed to redirect users to malicious content. The document body, though partially corrupted, contains text related to calculating voltage, which is likely a lure to disguise the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8277

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pistant.ru/uplcv?utm_term=how+to+calculate+voltage+across+a+resistor
    • http://aiswaryamatrimonials.com/fck_uploads/file/57437140810.pdf
    • https://www.novet.de/wp-content/plugins/formcraft/file-upload/server/content/files/1609866449f7d9---jubenemajiwogosesuligufi.pdf
    • https://www.frankcapassoandsons.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080746240357---gebozurofegabonokelikiwo.pdf
    • https://leicht-spb.ru/wp-content/plugins/super-forms/uploads/php/files/3b89e7f98fbbe90a1592d6fd2fa5a6f0/dopegaruputupumewinulu.pdf
    • https://luminex.pl/upload/file/vavawazikixap.pdf
    • http://maychamsocda.vn/images/userfiles/file/77524340250.pdf
    • https://miamiuniquelimo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073d5bb59c9d---70722203115.pdf
    • https://metroguards.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607a36d8ca1cb---37613369340.pdf
    • http://brette-animation.com/userfiles/file/38399378020.pdf
    • http://in-dapt.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090aaf448896---84265527719.pdf
    • http://dynamic1984.com/user_file/file/busofi.pdf
    • http://biomassasia.net/data_ed/userfiles/file/wumupetegabexofipum.pdf
    • https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/e81531d89f56ac7bd509b2afeae0943a/ropodatazutokamul.pdf
    • http://konditsionery-reutov.ru/upload_picture/file/zakaziw.pdf
    • http://vudafrique.com/wp-content/plugins/super-forms/uploads/php/files/fef29a4ef9e8cfadbab041195a16ef4e/87230790165.pdf
    • https://torrentclub.vip/wp-content/plugins/super-forms/uploads/php/files/ru43rllb3bn66qgot0162oq8cl/vowodesi.pdf
    • https://askopenko.com/wp-content/plugins/super-forms/uploads/php/files/f7a9292092f96655db7ea9af52386ae3/fakotovitoxef.pdf
    • http://app8itebarandgrill.com/admin/images/file/domakataraxipenabopexe.pdf
    • https://webtraffic.ch/wp-content/plugins/super-forms/uploads/php/files/3ruqloqbvkvb7ht2p257ucigcm/65408550802.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc79.bin
f7c25603b153ca21f13cef1273584ec63b94291ca5b8b3d18e3263ea83db002e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC79 5568 bytes
font_01_sfnt_off0001103b.bin
53e321b8fe1a403b7fd3987655d9669cf31cca717219dee6c45aa90647a26742		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1103B 5080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.