Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee275be35936391c…

MALICIOUS

PDF

66.6 KB Created: 2021-06-11 00:38:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d283cdf041804cc7dfc4737733a273d0 SHA-1: 289cc8742414245a3f6d2cd2ba764dccc4959cb8 SHA-256: ee275be35936391cf659f840c4d1f6473cc9659b909a2c9e5c64aa8044a0dd59
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a link farm pointing to compromised WordPress sites, likely intended to distribute malware or facilitate phishing. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' and the presence of multiple URLs on potentially compromised domains strongly suggest a malicious intent to redirect users. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9695

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oniceh.ru/uplcv?utm_term=download+filmora9+for+android
    • https://maugli24.ru/wp-content/plugins/super-forms/uploads/php/files/4765adb7c794d8a830eba75c41126718/nadoloxu.pdf
    • http://www.adanakursmerkezi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160750fad4ad20---kaxudiratobokadanu.pdf
    • http://terapie-psi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1609c30852e162---giwisokurogus.pdf
    • http://mobilieroccasion.fr/uploads/file/kofajegevefufibiwejigogop.pdf
    • https://gfow.om/wp-content/plugins/super-forms/uploads/php/files/jneun0ll6cbjha88qe9fqdhr7o/bufanunividexezijuza.pdf
    • http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1609834575f96e---39366402599.pdf
    • http://www.expertnutritionadvisor.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083da8026920---simebovusura.pdf
    • http://www.onekaddy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cd6723afb3---99389955382.pdf
    • https://inclinedigital.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a8c8ebb5f7---51357371352.pdf
    • https://chamsocmuihong.com/wp-content/plugins/super-forms/uploads/php/files/i285u52tgm1kj8chc8vvrmhq1e/xovawowexobotazud.pdf
    • https://rmdschoolandcollege.com/wp-content/plugins/super-forms/uploads/php/files/b4eidsrt8569gtbvrflvf19tl3/nedafe.pdf
    • http://www.nbrownies.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160829f7aaea3f---renen.pdf
    • http://inlikeflintlogistics.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609913a05260d---5012602982.pdf
    • http://alpanelektrik.com/depo/sayfaresim/file/wuxuze.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e901.bin
5499346a0b95ddba3428886c0a6a5d26bb68707bcee1e0fcd7d0e659f0c2eac2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE901 5124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.