Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ab73f6852d88056…

MALICIOUS

PDF

84.3 KB Created: 2021-04-29 07:23:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dac661628d70d744b8bb98fb44055d8f SHA-1: 65fc687912190748aa20df1fa295144bf64eb4e3 SHA-256: 9ab73f6852d880564a11de6dacacad4ec69b8ccdd80ac1ca90c2693835a7b063
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains numerous links to external websites, many hosted on compromised CMS platforms, suggesting a link farm designed to redirect users to malicious content. The presence of embedded URLs and the overall structure point towards a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8959

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xn--90ad5ackt1d.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/68d9c6768b6e6718194a2b4ec202a562/84541784389.pdf
    • http://associacaoguainumbi.org.br/wp/wp-content/plugins/formcraft/file-upload/server/content/files/16078c621a62c3---xagedikogexofiwu.pdf
    • http://www.cheapmotorcycleinsurancepa.com/wp-content/plugins/super-forms/uploads/php/files/5p1n97325tcpn9ci8o5vj1ldd6/komogekizedupe.pdf
    • https://thesmithgrouphouston.com/wp-content/plugins/super-forms/uploads/php/files/0e2a64c0aa22dae821461bc8080739a5/demegonopejefuwapu.pdf
    • http://trackeg.com/en/wp-content/plugins/formcraft/file-upload/server/content/files/1606cbfaf0f075---53585759942.pdf
    • https://ludifrance.fr/userfiles/file/26151157816.pdf
    • https://njsolarpower.com/wp-content/plugins/super-forms/uploads/php/files/c70c2172c835832975e1c4fc4ae15186/pegisi.pdf
    • https://proff-doors.ru/wp-content/plugins/super-forms/uploads/php/files/45df772be26216ae3538b2a632b93e08/74420630612.pdf
    • https://sipsib.ru/wp-content/plugins/super-forms/uploads/php/files/bc5da6bd0adf69e020b8316fe8ca2e29/ramusugikod.pdf
    • http://steclotildehorton.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607a459114c59---tusemefavage.pdf
    • http://evabody.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160883fc099901---jogefojapagar.pdf
    • http://asu.com.vn/wp-content/plugins/super-forms/uploads/php/files/gvfp3ekq68vmuvtf3pirikfsu5/libanigoxavapo.pdf
    • http://www.tif.cn/wp-content/plugins/super-forms/uploads/php/files/om9bsfrs0c43c0qdbkv7omq99r/25145657989.pdf
    • https://www.lorenzofranzone.it/wp-content/plugins/super-forms/uploads/php/files/e90180c8c9282367acf5d946642a68c3/81993832216.pdf
    • http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160717e93ae35b---63587030892.pdf
    • http://www.saraviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072b3dea7e14---34592308198.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/DOqCt-cVA4I/uplcv?utm_term=national+lampoon%2527+s+vegas+vacation+parents+guide
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010115.bin
687c0d34549cc4f7e4c71b928edbfdee0c4b207bfba5e41c5452cb8371da2bf7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10115 5456 bytes
font_01_sfnt_off000113a2.bin
31bde7f27facf39166b79566c2e4e79ce5a25b147ef87d7520504e19b225e918		 pdf-font-stream PDF embedded font (sfnt) at offset 0x113A2 11300 bytes
font_02_sfnt_off00013a2c.bin
b6bf7e36580f6da456cdd270219ed7ea85bd2a7c18d725b48e8184695280d628		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A2C 16260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.