Malicious PDF — malware analysis report

Static analysis result for SHA-256 c58849e9e6a38095…

MALICIOUS

PDF

81.8 KB Created: 2021-07-06 15:17:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: 7a78b8665d3926f51584b7337b69256b SHA-1: 87b507873c5ba1a1a5bf521c7a41e34305790bde SHA-256: c58849e9e6a3809562c77b05184ae9c5c955cdfd60cac7bd8db123e319f30c9b
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and numerous external URIs, many of which point to compromised CMS upload directories. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the document is designed to host a large number of links on disposable hosting, suggesting a phishing or malware distribution campaign. The embedded JavaScript likely facilitates the redirection to these malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8854

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://yuemeism.com/uploadfiles/files/weledoxofe.pdf In PDF document text
    • https://regalcabs.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1609ad0aec2f8a---nonagubevokamegadupi.pdfIn PDF document text
    • https://deepex.hu/hirek/files/tepol.pdfIn PDF document text
    • http://xperion.hu/wp-content/plugins/super-forms/uploads/php/files/459f2f63a018cc135b0ffcb1134e9302/rilibumagukunesojesixaxak.pdfIn PDF document text
    • http://www.jhannahs.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a8ce5885608---nonimo.pdfIn PDF document text
    • https://siyata.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/160848941c2433---lupurodotepu.pdfIn PDF document text
    • https://agrotehholding.ru/wp-content/plugins/super-forms/uploads/php/files/e37d43c58856bb6fa905034365829f44/20914056656.pdfIn PDF document text
    • https://jfefood.com/wp-content/plugins/super-forms/uploads/php/files/bfa02cecf05938f2e050d802d12a15c5/nirozigekujitimutekob.pdfIn PDF document text
    • https://fermuar.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083acb241811---69152148862.pdfIn PDF document text
    • http://kingspec.su/wp-content/plugins/super-forms/uploads/php/files/paqocsvu6249jsrqfsvm13e0eo/61617575161.pdfIn PDF document text
    • http://dossalas.com/wp-content/plugins/super-forms/uploads/php/files/fc6fe9b62fc12bacd716d3a5f613c357/53199904832.pdfIn PDF document text
    • https://saftanton.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160db7f62effd2---19839672154.pdfIn PDF document text
    • http://reikihaus.com/clients/75291/File/zepigoxaku.pdfIn PDF document text
    • http://kco.su/userfiles/file/62474401188.pdfIn PDF document text
    • http://titibbs.xyz/js/ckfinder/userfiles/files/parejogadolebovaratoxu.pdfIn PDF document text
    • http://crmrealty360degree.in/userfiles/file/petafaxedoduwupapewisas.pdfIn PDF document text
    • https://cremyco.com/app/webroot/docs/file/fiziderefinidelixosoto.pdfIn PDF document text
    • https://moma-restaurant.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b0dd99cd438---14814438405.pdfIn PDF document text
    • https://oiweld.com/wp-content/plugins/super-forms/uploads/php/files/b1321835a868083de2331027ec235c16/rifaz.pdfIn PDF document text
    • https://yomadesign.com/userfiles/Proj_Name//files/mizidiwidopiforifexid.pdfIn PDF document text
    • https://www.elektrobetrieb-scholz.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a1206c96cda---nusikemirerimi.pdfIn PDF document text
    • https://alatheir.com/atheirwsfiles/file/15074278537.pdfIn PDF document text
    • http://c-six.it/userfiles/files/83270646823.pdfIn PDF document text
    • https://nuregio.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606d2fdd9a836---92106399587.pdfIn PDF document text
    • https://patriot.ch/wp-content/plugins/super-forms/uploads/php/files/8v6t65cli0lelrdk5ejvhqejg6/92676903431.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=political+science+question+and+answer+in+bengaliPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d5f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD5F9 11016 bytes
SHA-256: 61ca05d2c89efdd694b096575653bd9ff36e6ed4e48305b3ab6a0f6256e785a1
font_01_sfnt_off0000ef3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF3D 16892 bytes
SHA-256: 7bb558c053dc4e043e6ec2b99395c9865f054a5c24d8cc6c1cc1224a35179b35
font_02_sfnt_off000106f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106F8 16484 bytes
SHA-256: dd7a0643a915260128396f227e6855cb9583e8eb567b089ed6428d506ca90566
font_03_sfnt_off000131f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x131F9 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.