Malicious PDF — malware analysis report

Static analysis result for SHA-256 e857414730c1353d…

MALICIOUS

PDF

490.9 KB Created: 2021-06-04 12:47:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 6dcdbbe56e86a9358060286b4cdde1b0 SHA-1: c2041f726b2134d0f74e341f1b6d888669af92e8 SHA-256: e857414730c1353d0d2293ca8541d71fd21723d90e8cd51b7f0b1aff6b1c2711
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The file is identified as malicious by ClamAV with a 'Pdf.Phishing.Trojan' signature, indicating a phishing attempt. The PDF contains numerous links, many pointing to compromised WordPress upload directories, suggesting a link farm used to host or distribute malicious content. The document body, though heavily obfuscated, contains references to 'Oxford advanced learner's dictionary full version apk' and 'wkhtmltopdf', likely a lure to trick users into downloading and opening the malicious PDF.

Machine Learning

  • Nyx PDF Classifier clean score 0.1040

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://perleyparish.org/wp-content/plugins/super-forms/uploads/php/files/189391935d98e26aa64384a900701ceb/karodalaju.pdf In PDF document text
    • http://ks4073.com/file_media/file_image/file/wobofijotabepi.pdfIn PDF document text
    • https://bamfieldrental.com/userfiles/file/21100829514.pdfIn PDF document text
    • https://aguiapromocional.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1608fb8b22a51c---wonuziv.pdfIn PDF document text
    • https://hacunamatata.ru/wp-content/plugins/super-forms/uploads/php/files/4775a5455d660854347e43c0d2795cec/92242499640.pdfIn PDF document text
    • http://bochosushi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ffb285242c---pivovazemigusakuzilup.pdfIn PDF document text
    • http://www.rebranded.tv/wp-content/plugins/formcraft/file-upload/server/content/files/16079679425f9a---42017865477.pdfIn PDF document text
    • https://irrisyst.eu/files/file/nuwebunofepunub.pdfIn PDF document text
    • https://suemsas.com/wp-content/plugins/super-forms/uploads/php/files/vl7gv1t7n8n2q9dmhageqjrhq0/nixakesatawavo.pdfIn PDF document text
    • https://www.straightmyteeth.eu/wp-content/plugins/super-forms/uploads/php/files/75c94eb2c93ded0cb7de20a432315833/18080968062.pdfIn PDF document text
    • http://optimus.org.au/wp-content/plugins/formcraft/file-upload/server/content/files/160833d28ddfa2---zakuj.pdfIn PDF document text
    • http://www.catalogodecineargentino.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b8bc99f1eeb---31817630980.pdfIn PDF document text
    • http://www.a-fairys-choice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609ce7de4216b---14367967646.pdfIn PDF document text
    • http://conservationenergy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a0fde2e1aa5---lipogenemofalijebosivemiv.pdfIn PDF document text
    • https://www.bouwenaaneensterkwerkgeversmerk.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1609db780c0168---fafav.pdfIn PDF document text
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/k10vl6t5k83gpn1en23a9rj2kt/38184931818.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=oxford+advanced+learner%2527s+dictionary+full+version+apkPDF link annotation

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00070de3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x70DE3 53860 bytes
SHA-256: 6e50a227bc6b217e5b9a3246ced0156c8040850fb332a4268fb9fbdaf4af077f

Open this report in the interactive analyzer, or submit your own file for analysis.