Malicious PDF — malware analysis report

Static analysis result for SHA-256 969926cfba6b8ffc…

MALICIOUS

PDF

63.7 KB Created: 2021-07-01 00:51:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 4b64303c5c1b3c4fb654ac0f8c359f5e SHA-1: 465b3763e94b05ed5a56938d59caa73b127fb6a6 SHA-256: 969926cfba6b8ffca949f34e0130aeba704bbe013f59e111a4c8452ee81d4c78
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of links, many of which point to compromised or disposable hosting domains, as indicated by the 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM' heuristics. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware delivery. The embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8532

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://alliance-ic.ru/uploads/file/gifejo.pdf In PDF document text
    • http://jjinline.org/file_upload/file/37765787251.pdfIn PDF document text
    • https://autosaloncenter.com/uploads/file/xofakegumalumilavomimizaw.pdfIn PDF document text
    • http://wwstationery.com/files/file/50283352988.pdfIn PDF document text
    • https://www.vibrationmonitoring.asia/wp-content/plugins/formcraft/file-upload/server/content/files/160c93dc4d0179---dujuro.pdfIn PDF document text
    • https://bilbox.es/wp-content/plugins/super-forms/uploads/php/files/a5bfc366de8a8dd829fb7ed278d5b993/fujopitagugimemimofonan.pdfIn PDF document text
    • http://www.jindatunnel.com/up_files/file/27249635272.pdfIn PDF document text
    • https://beautifullifeuk.com/wp-content/plugins/super-forms/uploads/php/files/ee24ca0b778657237899e541f9b4fffe/19154945245.pdfIn PDF document text
    • https://stagerightstaging.com/wp-content/plugins/super-forms/uploads/php/files/d927f231b1ecb1f49b1cb7d626a0e22d/jogomididiniv.pdfIn PDF document text
    • https://goldenparadisestsimons.com/wp-content/plugins/super-forms/uploads/php/files/f8391606b6f0f7969eab2e8810451e21/sodaroxaniberamo.pdfIn PDF document text
    • https://mediabandit.com/wp-content/plugins/formcraft/file-upload/server/content/files/160824ace27168---11535240017.pdfIn PDF document text
    • http://www.southforconstruction.com/frontend/web/ckfinder/userfiles/files/61747759925.pdfIn PDF document text
    • https://evocative.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16085aaf83edff---wagofesokepumezive.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160871e2b95590---dasisore.pdfIn PDF document text
    • https://mziagroup.com/wp-content/plugins/super-forms/uploads/php/files/q5791tbil4pc7cntj6tnpk53r8/93194330833.pdfIn PDF document text
    • https://1sis.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079edfa9b5b1---wolowipenoxagosexa.pdfIn PDF document text
    • https://bayardplaza.co.uk/wp-content/plugins/super-forms/uploads/php/files/verlijue6jtrf9spe0k96l9nf1/saponazabefobuja.pdfIn PDF document text
    • https://www.sharpeningfactory.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c75095b2a9f---75607401603.pdfIn PDF document text
    • https://www.sblending.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1609c367f3949c---42005633954.pdfIn PDF document text
    • https://agenciaboom.com/wp-content/plugins/super-forms/uploads/php/files/vs8m2qtu9t82jf8u05gae1r8r3/98878498467.pdfIn PDF document text
    • https://envomask.com/wp-content/plugins/super-forms/uploads/php/files/6d6d11a36704843f0b204261832c83bc/40947508221.pdfIn PDF document text
    • http://www.segurosfacility.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609cb87bd66f0---kemaloxokige.pdfIn PDF document text
    • https://www.capitalroofingct.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087d5c105c9d---9122495573.pdfIn PDF document text
    • https://utilitydiscount.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ef6ac99a72---66293690853.pdfIn PDF document text
    • http://leap-egypt.com/wp-content/plugins/formcraft/file-upload/server/content/files/16093e96d1ef90---kiwiwoparetarav.pdfIn PDF document text
    • http://perseverance.cyou/updatefiles/file/37057804338.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1KS0DP0cxss/uplcv?utm_term=1+shot+glass+is+how+many+ouncesPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ccb9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCCB9 16976 bytes
SHA-256: 5c9fd74ad7ebb503292f519fd3b454979bc509e75a318ecdce2b1aa35113d712

Open this report in the interactive analyzer, or submit your own file for analysis.