Malicious PDF — malware analysis report

Static analysis result for SHA-256 e871a21dc1c610f9…

MALICIOUS

PDF

65.0 KB Created: 2021-09-14 03:47:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24
MD5: e366735a6c56cc628820a3d6b7d6e54a SHA-1: dcdf52f773b274bb4074b1f0735f97be0d488c45 SHA-256: e871a21dc1c610f9b1dcafe473b663cb107828f1fd0051891d7001bbf8890be6
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample was detected as a malicious PDF by ClamAV and ML classifiers, indicating it's likely a phishing or malware distribution lure. It functions as a link farm, with numerous URLs pointing to various domains, some of which are associated with compromised CMS uploads or disposable hosting. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic suggests these links are used for SEO manipulation or to obscure malicious destinations. No scripts were extracted, but the overall structure points to a malicious document intended to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6564

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://elencostruzioni.it/userfiles/files/86469542796.pdf In PDF document text
    • https://lingchuanfloor.com/app/webroot/userfiles/files/96150512015.pdfIn PDF document text
    • http://naasschoolofmotoring.com/fckeditor/userfiles/file/49451955129.pdfIn PDF document text
    • https://mkting.com.co/wp-content/plugins/super-forms/uploads/php/files/a9d5891ced51410856172cab964c3f2d/ketenebalubazetuzala.pdfIn PDF document text
    • http://www.enjoyvaltellina.it/admin/ckfinder/userfiles/files/85056477860.pdfIn PDF document text
    • http://www.bluewhaleline.com/image/upload/File/tunizabegipofigakatuni.pdfIn PDF document text
    • http://huijingweb.com/upload_fck/file/2021-9-12/20210912225700796564.pdfIn PDF document text
    • https://www.agencesramos.com/ckfinder/userfiles/files/puzijubusobividalu.pdfIn PDF document text
    • http://www.jindatunnel.com/up_files/file/golikisuzam.pdfIn PDF document text
    • http://adasbruiloften.nl/userfiles/file/69955424867.pdfIn PDF document text
    • http://hoaiduc.edu.vn/ckfinder/userfiles/files/nunimeba.pdfIn PDF document text
    • http://herborgthailand.com/file_media/file_image/file/93268944570.pdfIn PDF document text
    • http://solarwindependence.com/ckfinder/userfiles/files/10377936695.pdfIn PDF document text
    • https://humantouchtranslations.com/wp-content/plugins/formcraft/file-upload/server/content/files/1/1613fedc5ccdf8---13061839271.pdfIn PDF document text
    • http://www.moyekolodin.com/files/madadibu.pdfIn PDF document text
    • http://www.mab-solutions.fr/upload/file/16134108360.pdfIn PDF document text
    • https://doitsolutions.co/wp-content/plugins/super-forms/uploads/php/files/491281b51cf4f45ff1219aec7014f5ef/4976020404.pdfIn PDF document text
    • http://ankaraeksioglu.com/resimler/files/zupalere.pdfIn PDF document text
    • https://www.opdrrustukalac.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612f554f7c0e5---74556063470.pdfIn PDF document text
    • https://rowsontw.com/shopadmin/upload/files/godafomaxafu.pdfIn PDF document text
    • https://www.hmgfinance.com/ckfinder/userfiles/files/vupowe.pdfIn PDF document text
    • https://52fantasies.com/home/holly/public_html/ckfinder/userfiles/files/jezobip.pdfIn PDF document text
    • https://yellowstonewildlife.com/99188599830.pdfIn PDF document text
    • http://only-svet.ru/upload/files/vorusexafugag.pdfIn PDF document text
    • http://xn--krmer-dnnebacke-1kb72b.de/files/file/78410143979.pdfIn PDF document text
    • https://locktactyuma.com/ckfinder/userfiles/files/85390544064.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=novation+launchpad+android+appPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed8c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED8C 10456 bytes
SHA-256: 074ddc6e70e76296ef3b23e327129bcc6b96176d2c7c28723b615b7ed546bec7

Open this report in the interactive analyzer, or submit your own file for analysis.