Malicious PDF — malware analysis report

Static analysis result for SHA-256 e53e0560e25cdcd2…

MALICIOUS

PDF

86.7 KB Created: 2021-06-27 05:59:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 6fec469b4dd6dbcbee6b67c9764b6f6c SHA-1: 09a969feaae136e2a37e5b3d276947d09e766842 SHA-256: e53e0560e25cdcd265e0b3040d20746e648d37ca59ff42a7ef1be308734d9e29
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as malicious by ClamAV and an ML classifier, with high confidence. Heuristics indicate it functions as a link farm, pointing to multiple compromised WordPress sites. These links likely serve as lures for phishing or to distribute further malware, as suggested by the 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM' findings.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ncfouting.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607db4a20db3c---zuwanu.pdf
    • http://medica-eg.com/userfiles/file/raboliresajogorazipezok.pdf
    • https://vuaship.com/wp-content/plugins/super-forms/uploads/php/files/6cbmgltf86o570tbaudhmkm26p/42904010367.pdf
    • http://rhodeislandalpha.com/clients/56223/File/ropumabaporeloripaxulu.pdf
    • https://anzmrrn.org/wp-content/plugins/formcraft/file-upload/server/content/files/160763caa7a5a2---34504239761.pdf
    • http://philippinesroadshow.com/wp-content/plugins/super-forms/uploads/php/files/2aaeb585e1b7e98c2dcb72c7afe0744a/zopaga.pdf
    • http://indiebookoftheday.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d03cd463ce7---86990658458.pdf
    • http://tecsun-moscow.ru/docs/file/29616472385.pdf
    • http://funkyspa.net/ckfinder/userfiles/files/49434936211.pdf
    • https://cor.org.ar/wp-content/plugins/super-forms/uploads/php/files/9vkfnlvvh601bvbi5g4fs2g784/noluvakunanek.pdf
    • https://brmc.jp/user_data/userfiles/files/27800481930.pdf
    • https://yuss.it/file/xekegebusuvomexizerafu.pdf
    • https://advance-pack.com/editor_upload/file/jatuwek.pdf
    • http://wksystems.net/HotelEstimator/userfiles/file/lojupo.pdf
    • https://sportli.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/16083495dd425a---zogifujopajewar.pdf
    • http://lisahyatthealth.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087133e90e13---winimi.pdf
    • https://atx-stroy.ru/wp-content/plugins/super-forms/uploads/php/files/7cf876f1c1119ddc760867865b600cfc/50562498952.pdf
    • http://www.mkkdigital.pt/wp-content/plugins/formcraft/file-upload/server/content/files/1606dbf978f832---jisariwebikukukig.pdf
    • http://joshuadacosta.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c1aa7fa217e---21066018788.pdf
    • https://www.generalutilities.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607bc4a51da6b---30248418533.pdf
    • http://unternehmensberatung-hegenbarth.de/userfiles/file/lepoxigijarererapubuja.pdf
    • https://laihouston.com/wp-content/plugins/super-forms/uploads/php/files/4905824e02f22451329a2afb15ebf238/11104460614.pdf
    • https://nailseasupportgroup.com/wp-content/plugins/super-forms/uploads/php/files/645c28450e1d4da312fc2b8f3661b761/58187885182.pdf
    • https://ateneoarbonaida.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bd495ef1fae---91475567186.pdf
    • https://www.sussexweddingservices.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606e4e97e5452---50396631309.pdf
    • https://feedproxy.google.com/~r/skout/mBVl/~3/YTWXjIUwRh0/uplcv?utm_term=probability+sampling+meaning
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef5b.bin
116548df1814374e428b9b1cb5c04100e6fce3116125db1b17f3f4e569af4946		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF5B 17340 bytes
font_01_sfnt_off00011cb2.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CB2 16792 bytes
font_02_sfnt_off000134c9.bin
ff792470c79742dde637beb4e2b736bf5d4e82862ae128f328edc8cff1eff827		 pdf-font-stream PDF embedded font (sfnt) at offset 0x134C9 10848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.