Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f60ebcd79511bb3…

MALICIOUS

PDF

70.3 KB Created: 2021-06-17 13:14:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: e03a2df0ee10fb533b5605df1f93a0ad SHA-1: ee9be9a5ccc551f080e55e041c34dff51a1745b4 SHA-256: 9f60ebcd79511bb3773033b37f4e06e665657376456bff8524aa66ddf3b79aa3
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document that contains multiple links to compromised websites, indicating a phishing or malware distribution attempt. The ClamAV heuristic specifically flags it as 'Pdf.Phishing.Trojan', reinforcing the malicious intent. The document body, though heavily obfuscated, suggests a lure related to a 'character sheet'.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3194

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oniceh.ru/uplcv?utm_term=mage+the+ascension+20th+anniversary+character+sheet PDF link annotation
    • http://misspacificus.com/clients/873634/File/22891248142.pdfIn PDF document text
    • http://timatey.kz/wp-content/plugins/super-forms/uploads/php/files/7e0usbep67fhcrrkoenkp6htb3/mexil.pdfIn PDF document text
    • https://www.lowdoc-loans.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160c31404289dd---58111874287.pdfIn PDF document text
    • https://mikepromedia.com/wp-content/plugins/super-forms/uploads/php/files/otktdb777qk8q94aou8priftv6/59576095504.pdfIn PDF document text
    • https://actor-conseil.com/files/file/sozetujo.pdfIn PDF document text
    • http://www.morenoroofing.com/wp-content/plugins/formcraft/file-upload/server/content/files/160983a517f518---zejabofa.pdfIn PDF document text
    • https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/ud5eungn5m04li95hr4trfqg3h/bipapizusedidozitir.pdfIn PDF document text
    • https://www.cibaospalaser.com/wp-content/plugins/super-forms/uploads/php/files/aqb1kmt2asgk1dk1q0tck2s5he/1431865366.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.