Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac53edc87e9ecf32…

MALICIOUS

PDF

98.4 KB Created: 2021-07-22 13:50:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05
MD5: c2bfcaa54d7fd1223abc8b30aa784ea1 SHA-1: 1b5567ae948770ab5e61fe0a5433d2baed421222 SHA-256: ac53edc87e9ecf3277afdca3234b5654c79cd6683d684f488da2bca833508776
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous links to external resources, many of which point to compromised CMS uploads and disposable hosting. The ClamAV detection indicates this file is a phishing or trojan PDF. The presence of multiple links suggests an attempt to redirect the user to a malicious payload or phishing page.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2793

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vitali-schulz-eiskunstlaufen.de/userfiles/files/50603659469.pdf In PDF document text
    • https://homini.eu/wp-content/plugins/formcraft/file-upload/server/content/files/1609b9a5231c2a---talilar.pdfIn PDF document text
    • https://mimpi1pusat.com/contents//files/tarukofotepotege.pdfIn PDF document text
    • https://bhsbeacon.com/FCKeditor/file/tejotugazefaxoxomurabol.pdfIn PDF document text
    • http://strap.sk/uploads/files/32376843813.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609acc148da6a---41153547397.pdfIn PDF document text
    • http://www.sunarnuricomuisvealisverismerkezi.com/wp-content/plugins/super-forms/uploads/php/files/9dsg5k7lksmo1megs2o0v0apg7/67485911545.pdfIn PDF document text
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160978963d7e18---ripesuva.pdfIn PDF document text
    • http://spoilersmensgolfclub.com/clients/865201/File/92074941910.pdfIn PDF document text
    • http://maxtarget.by/ckfinder/userfiles/files/begutotarej.pdfIn PDF document text
    • https://revapackers.com/wp-content/plugins/super-forms/uploads/php/files/gbrvs20utdnc4mbd86g8em70tg/tunibanonujujubovutadixu.pdfIn PDF document text
    • http://irinaburmistrova.ru/files/29682146885.pdfIn PDF document text
    • http://ajivikafinance.com/userfiles/file/zugidilogupekejixakim.pdfIn PDF document text
    • https://www.tonygssoulfood.com/wp-content/plugins/super-forms/uploads/php/files/873e5138b578a2308fa24b16a623e4a8/tujig.pdfIn PDF document text
    • https://rlvanstory.com/wp-content/plugins/super-forms/uploads/php/files/285a46b4b49de77a3f2d99f151fe3ef2/34755890682.pdfIn PDF document text
    • https://inchiriereelicoptere.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160a934443108e---wevoxasolumakemerabazosow.pdfIn PDF document text
    • http://atol-res.pl/uploads/file/mewadekofa.pdfIn PDF document text
    • https://autotrilogy.com/wp-content/plugins/super-forms/uploads/php/files/5c8d217092e758c08101808524b004f5/kipokubipadu.pdfIn PDF document text
    • https://graffitipaintstudio.com/wp-content/plugins/super-forms/uploads/php/files/87ba71f9e46ab3f23466a4ca37c2c28d/74968812060.pdfIn PDF document text
    • http://helpibr.org/clients/f/fe/feaff840d005acecac0f151e8679c8db/File/37734669591.pdfIn PDF document text
    • https://3eyamaichi.com/upload/ckfinder_temp/files/20210720113359.pdfIn PDF document text
    • https://solidpractise.com/files/userfiles/file/wiluvedagewexosixurema.pdfIn PDF document text
    • https://kodcomputers.ro/2664/uploads/veminebitetirezojelokor.pdfIn PDF document text
    • https://afanasyev-design.ru/wp-content/plugins/super-forms/uploads/php/files/abaa9b16cf3e9adf2e00128d6e2ff885/kedagadagijawulevevu.pdfIn PDF document text
    • https://qualitycountscleaning.com/wp-content/plugins/super-forms/uploads/php/files/87c030e45ff10f2bdfcdc753131454c1/lizijujozaxotujub.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=chad%27s+videos+oatPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013cca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13CCA 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off000154dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x154DC 18156 bytes
SHA-256: 255a207259f697658c02ab2191367aa50d994ced3894875f6692c340985f3e2f

Open this report in the interactive analyzer, or submit your own file for analysis.