Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea76936521094596…

MALICIOUS

PDF

69.3 KB Created: 2021-09-07 01:08:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: ed426004b72e903d0327b7ba6ed96dbf SHA-1: ff052eea419c94719926251618ece6103e93df52 SHA-256: ea769365210945963293900846dbd25d42a7acb975f018f0f539f8999d55a451
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected by ClamAV as Pdf.Phishing.Trojan and exhibits characteristics of a link farm, with numerous embedded URLs pointing to potentially compromised websites or disposable hosting. The heuristic PDF_SEO_DISPOSABLE_LINK_FARM indicates a deliberate attempt to create a network of links, likely to distribute malicious content or phish for credentials. No scripts were extracted, but the PDF structure itself facilitates the redirection to these external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5820

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://huntic.ru/uplcv?utm_term=gop+hai+file+pdf PDF link annotation
    • https://zibarajabi.com/cache/fck_files/file/29829775725.pdfIn PDF document text
    • http://sswjeans.com/files/95701771432.pdfIn PDF document text
    • https://rodolphe-blanchet.fr/Rodolphe/fckeditor/file/gumedekinegazipapamosex.pdfIn PDF document text
    • https://kenkochaya.com/user_data/ckfinder/files/gezadabotavapakoki.pdfIn PDF document text
    • https://cuisinescartier.ca/upload/editor/file/nidujefewupekiv.pdfIn PDF document text
    • http://omegapizza.net/uploads/files/piwodovebiku.pdfIn PDF document text
    • http://sonhanint.com/uploadpic/sun/files/202108110824498335.pdfIn PDF document text
    • http://kazenergy.kz/wp-content/plugins/formcraft/file-upload/server/content/files/160bd649f4af44---66695412518.pdfIn PDF document text
    • https://dalyanestate.com/userfiles/file/49605468580.pdfIn PDF document text
    • http://associacaoguainumbi.org.br/wp/wp-content/plugins/formcraft/file-upload/server/content/files/1606cef0e54213---lanolubafevak.pdfIn PDF document text
    • http://nuuts.mn/uploads/assets/sapuwimisomuk.pdfIn PDF document text
    • https://ivanda-commerce.hr/userfiles/file/9030619664.pdfIn PDF document text
    • http://195exim.com/datas/files/83655994391.pdfIn PDF document text
    • https://www.nestroots.com/wp-content/plugins/super-forms/uploads/php/files/8676fh6bhv07a2j92h3j9dum53/bikib.pdfIn PDF document text
    • http://labsshop.com/d/files/xefijuvikajumi.pdfIn PDF document text
    • http://blissworldbeauty.com/newerac2c/userfiles/file/sozolejituk.pdfIn PDF document text
    • http://aeskulap24h.de/wp-content/plugins/formcraft/file-upload/server/content/files/1613510a173bb3---muxepiparovekujupoveji.pdfIn PDF document text
    • http://fantalife.nl/userfiles/file/dafexiwonodefar.pdfIn PDF document text
    • https://lisacutler.com/wp-content/plugins/formcraft/file-upload/server/content/files/160985fc504e58---36405150421.pdfIn PDF document text
    • http://orgue-chantepie.info/FCKeditor/upload/file/kuzigirurekezalofi.pdfIn PDF document text
    • http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16072eacf18835---40489076040.pdfIn PDF document text
    • https://africanresearchcenter.com/userfiles/file/24363639641.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA1A 10164 bytes
SHA-256: 8cad96f2fe164b6600046d6410dcab672a6ff7eb016c43b4a74dc93a5ee0f5e0
font_01_sfnt_off0000f0e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0E5 1680 bytes
SHA-256: 6c08887b596ecb472c5a0482df8c2f828d83fc5b5d16111ed0caa1fced1b35dc
font_02_sfnt_off0000f8e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8E1 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.