Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd07efca15676ab6…

MALICIOUS

PDF

238.6 KB Created: 2021-06-14 16:14:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-24
MD5: 43931674841e985bd9a3cb6872f69f4d SHA-1: e9efbe94eec8dbf6300e6ea2261b8baf591d1bd4 SHA-256: bd07efca15676ab65691ac2f475fb1357f794537d003de613b4a639927899b5d
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The document contains numerous embedded URLs pointing to compromised WordPress upload storage, suggesting it is part of a phishing campaign designed to distribute further malicious content. The presence of external URIs and link farms further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9719

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crysiq.ru/uplcv?utm_term=fairy+tail+episode+163+english+dub PDF link annotation
    • http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607902e0b57a3---33716027722.pdfIn PDF document text
    • http://www.blackhillsdancecentre.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cc4b5d075e---jazusudedun.pdfIn PDF document text
    • https://xn----7sbabak5acz7byau.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/7921e5dc1d701552f6ecb5e36c240a80/sowigagopeniwuv.pdfIn PDF document text
    • http://www.sg-callenberg.de/wp-content/plugins/formcraft/file-upload/server/content/files/1609858002b055---rinawajizaxux.pdfIn PDF document text
    • http://writtenmail.com/upload_images/file/68331016641.pdfIn PDF document text
    • http://sochi-polyana.com/ckfinder/userfiles/files/pikarazi.pdfIn PDF document text
    • https://forex-robo.org/wp-content/plugins/super-forms/uploads/php/files/9e025419471092d1bba71b01a208d9c4/70600124719.pdfIn PDF document text
    • http://rethabise.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160ace3a0df023---mukofivivifalexazoxas.pdfIn PDF document text
    • https://trellisdundee.com/wp-content/plugins/super-forms/uploads/php/files/46d8adec8f3e18f5e151fa38bd67f28b/gidelulirigimu.pdfIn PDF document text
    • http://becro-plast.hr/wp-content/plugins/formcraft/file-upload/server/content/files/160746bfc67ed6---32458387359.pdfIn PDF document text
    • http://svenstavik.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d9effba427---73919227723.pdfIn PDF document text
    • https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b77e179beb0---papopegasezulowafu.pdfIn PDF document text
    • http://novichiha.ru/pic/file/wamorixamukisag.pdfIn PDF document text
    • https://www.vigo.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607b5aabd5bff---bojeviredisazo.pdfIn PDF document text
    • https://www.sir.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16075bc9042a83---93672894796.pdfIn PDF document text
    • https://www.3dreamchurch.com/wp-content/plugins/super-forms/uploads/php/files/e85c6d5a5aab53312800366b40c01b83/52846904116.pdfIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000204b0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x204B0 152280 bytes
SHA-256: ed26fd6d3ab6827fcf483e9d4bbbbfb2856b9a0499aef647dbbc2a2d5517dc80

Open this report in the interactive analyzer, or submit your own file for analysis.