Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae3fdbe289da139d…

MALICIOUS

PDF

64.0 KB Created: 2021-06-09 23:49:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 2a8f205da94a5c582de83e6bf3928c21 SHA-1: 1b88c600006d34f6b8d410affc65658d5d67b5ea SHA-256: ae3fdbe289da139d06bcbdb7bf6be1d13a23f6962a22f4d1a2f21574ee19c858
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous links pointing to compromised WordPress sites, suggesting a link farm designed to host malicious files. The presence of a specific search term in a URL indicates a phishing or social engineering lure to trick users into downloading malware. ClamAV detection and ML classification further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7679

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/uplcv?utm_term=yamunai+aatrile+song+mp4+free+download PDF link annotation
    • http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160832774e7d25---17622224168.pdfIn PDF document text
    • http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083add32f15e---70230804377.pdfIn PDF document text
    • http://argra.rs/wp-content/plugins/formcraft/file-upload/server/content/files/1608a2668635ae---senug.pdfIn PDF document text
    • http://sakirnoopo.ru/wp-content/plugins/super-forms/uploads/php/files/009377f1a9d3f52275beab9c78560b37/valudigifami.pdfIn PDF document text
    • https://expungemyrecordnj.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082403417d78---perawidikojodov.pdfIn PDF document text
    • http://rydelko.pl/userfiles/file/vomape.pdfIn PDF document text
    • https://ilc.ua/wp-content/plugins/super-forms/uploads/php/files/e7fakrjtovrjmfp2npu8q2t2i3/94897576829.pdfIn PDF document text
    • https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083f4f7d01b3---7400301095.pdfIn PDF document text
    • http://aaaexpressac.com/userfiles/file/zerotexolosomef.pdfIn PDF document text
    • http://totaleclipsenv.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d8a66b08f4---1785410251.pdfIn PDF document text
    • http://amtusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a490348b04e---50322734283.pdfIn PDF document text
    • https://kalyna.ua/sites/default/files/userfiles/file/79236862376.pdfIn PDF document text
    • http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b5639ee1e3b---61746753826.pdfIn PDF document text
    • https://realimpacto.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160836f093b73b---24554207520.pdfIn PDF document text
    • https://asiatravel.kg/wp-content/plugins/super-forms/uploads/php/files/1520350b76412cf8e6b862fc94f2b289/nabanexobebewuja.pdfIn PDF document text
    • https://davebakeragency.com/wp-content/plugins/super-forms/uploads/php/files/08c8bd98aee12a6ae18e96a2f8aede7a/41420411024.pdfIn PDF document text
    • http://www.optionassurance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609b7ecac420d---65378461256.pdfIn PDF document text
    • http://miamiwars.pl/wp-content/plugins/super-forms/uploads/php/files/ce14dbeb97244d3e77e4d0405bb31104/gexizitobotitebirapijota.pdfIn PDF document text
    • https://pypconsultores.mx/userfiles/file/zazugodijotonew.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f27d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF27D 5500 bytes
SHA-256: 966dbe314fb83f50fb4b1ae79600951398111c45b29cecd8e7e69ff39c49d310

Open this report in the interactive analyzer, or submit your own file for analysis.