Malicious PDF — malware analysis report

Static analysis result for SHA-256 9bcb61e67c4b5759…

MALICIOUS

PDF

521.2 KB Created: 2021-08-15 13:05:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: ef83ed8e276286ca29077be0d156cb54 SHA-1: f502e4c64c548ee00c870b0aa3d2a1c7b348a5b0 SHA-256: 9bcb61e67c4b575901eeb8fbd0a39d9dba074451790035c43e7adbe3c9eb6c3d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The ClamAV heuristic identified this PDF as a phishing trojan. Several embedded URLs point to compromised WordPress sites, suggesting a link farm designed to redirect users to malicious content. The PDF itself does not contain readable text, but the presence of these links and the critical ClamAV detection strongly indicate a malicious intent to exploit users via compromised web infrastructure.

Machine Learning

  • Nyx PDF Classifier clean score 0.0570

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://donnasalon.ru/wp-content/plugins/super-forms/uploads/php/files/36cebe92ec1c9487426d086c68b9105c/nuruveka.pdf In PDF document text
    • http://mkpstroitel.ru/upload/files/48586855579.pdfIn PDF document text
    • https://3dreamstudios.com/wp-content/plugins/super-forms/uploads/php/files/2160ba34cc8774906ffdfc2ec04b4662/49666989678.pdfIn PDF document text
    • https://baongochoa.com/upload/file/bosamutijigega.pdfIn PDF document text
    • http://klimatyzacjaradom.pl/userfiles/file/tubomevuwubelupewek.pdfIn PDF document text
    • https://ventana-sur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606fa5cea3513.pdfIn PDF document text
    • http://baigeleather.com/userfiles/file/dokipogufixizofazakito.pdfIn PDF document text
    • https://fetogram.ir/images/upload/files/zofoxotemaridanavezenum.pdfIn PDF document text
    • http://taxicityplus.ru/userfiles/file/javuwobefaralafudufin.pdfIn PDF document text
    • http://thehawthornnyc.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a1da827d654---maxaxid.pdfIn PDF document text
    • https://www.cedicar.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b325af30fa5---venim.pdfIn PDF document text
    • https://ooobelkom.ru/ckfinder/userfiles/files/9607214771.pdfIn PDF document text
    • https://readxyz.com/wp-content/plugins/super-forms/uploads/php/files/2b9489f124f6e1d44d21c7241bc4c0f8/fijatetapel.pdfIn PDF document text
    • http://atdawnwelift.com/userfiles/file/60001984650.pdfIn PDF document text
    • https://jetzterstrecht.hamburg/wp-content/plugins/super-forms/uploads/php/files/4lfglh1q7s29otj6sjlupp5o9p/54026433298.pdfIn PDF document text
    • https://grupo-bahia-real-estate.com/ckfinder/userfiles/files/tigibo.pdfIn PDF document text
    • https://higher-reason.com/wp-content/plugins/super-forms/uploads/php/files/21k4ntagpr97qfdsfnk428ekoo/zevonegugatinipanedonas.pdfIn PDF document text
    • https://habibitours.org/ckfinder/userfiles/files/79231672881.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/6naE_Nh8_CY/uplcv?utm_term=what+does+ian+gallagher+suffer+fromPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0007fb80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7FB80 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.