Malicious PDF — malware analysis report

Static analysis result for SHA-256 92f6390449c6758d…

MALICIOUS

PDF

87.3 KB Created: 2021-07-13 06:08:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: 0ae6e06ddc306cfa20e63278a2bf0a44 SHA-1: 5bd17bd44b5bce9ff5e73e2d9fd71d7752586d92 SHA-256: 92f6390449c6758d3ae3bb2bb29d51d148a28433dc48dede49fba24b20ad50c7
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains a link farm pointing to numerous URLs, many of which are hosted on compromised WordPress sites. The ClamAV detection and heuristic firings indicate this file is malicious, likely serving as a lure to phishing or malware download sites. The document body is heavily obfuscated and unreadable, providing no direct clues to its intent beyond the embedded links.

Machine Learning

  • Nyx PDF Classifier clean score 0.2133

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://clumba-indoor.ru/files/files/44496435016.pdf In PDF document text
    • http://snap-drone.com/userfiles/file/wegefigusanetujeto.pdfIn PDF document text
    • https://www.inkfactory.pk/wp-content/plugins/formcraft/file-upload/server/content/files/160a0a2b514251---44095175750.pdfIn PDF document text
    • https://miamiuniquelimo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c2a1b1e6fed---revujejisolebupap.pdfIn PDF document text
    • http://www.molinoag.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a06c2647680---bufapupekufisikevipinozad.pdfIn PDF document text
    • https://budapestpainter.hu/ckfinder/userfiles/files/45926057140.pdfIn PDF document text
    • http://www.tekkoo.net/images/library/File/44031930585.pdfIn PDF document text
    • https://storage-in-motion.com/wp-content/plugins/formcraft/file-upload/server/content/files/160927cea3d73d---galifejinabofokukiropus.pdfIn PDF document text
    • http://houselandia.ru/files/94292511357.pdfIn PDF document text
    • https://psychotherapie-dr-albrecht.de/wp-content/plugins/formcraft/file-upload/server/content/files/160ad8ce46350f---dexaxifida.pdfIn PDF document text
    • https://clinicamanila.com/ckfinder/userfiles/files/77020910044.pdfIn PDF document text
    • http://akbmodel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609b0d7648465---numudutoxutu.pdfIn PDF document text
    • https://utilitydiscount.com/wp-content/plugins/formcraft/file-upload/server/content/files/160974510c01aa---fogorufuxexevomipajezen.pdfIn PDF document text
    • https://amd-export.com/site/upload/file/tavelotaraxe.pdfIn PDF document text
    • http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b307b28f660---23716984578.pdfIn PDF document text
    • https://brusroom.com/wp-content/plugins/super-forms/uploads/php/files/fd750e882ae6005b9f944c132c4ed7b0/29977924378.pdfIn PDF document text
    • https://www.coconutlodge.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090860177855---57976423974.pdfIn PDF document text
    • http://usmleworkout.com/files/file/vakododizesumimavuzegemod.pdfIn PDF document text
    • http://cedresarquitectura.com/wp-content/plugins/formcraft/file-upload/server/content/files/16094116002f1c---69012363847.pdfIn PDF document text
    • http://charivne.info/images/file/nolalavafozefewowejek.pdfIn PDF document text
    • https://chambredhotes-savoie.com/ckfinder/userfiles/files/48571630030.pdfIn PDF document text
    • https://yziact.fr/wp-content/plugins/super-forms/uploads/php/files/8umn8gtl0ch4krm8alpp18n4do/zazixowobatiziruvuj.pdfIn PDF document text
    • https://www.vigo.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160c24996ad2ff---88729687206.pdfIn PDF document text
    • http://tinhdaurosa.com/Images_upload/files/xikiru.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=free+clothing+website+templatesPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe34.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE34 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0001164b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1164B 11024 bytes
SHA-256: 57d1ebe8716fb29c7c923ce5d54a505cd53bf9b5e7c492c0e322007707892835
font_02_sfnt_off00012f8a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F8A 16344 bytes
SHA-256: 327d4c7f34e3dda39022f974e466be2f20ca45e3d727b96fa65528431892e294

Open this report in the interactive analyzer, or submit your own file for analysis.