Malicious PDF — malware analysis report

Static analysis result for SHA-256 f1819bbb8cf19095…

MALICIOUS

PDF

71.9 KB Created: 2021-08-12 02:03:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23
MD5: 154f6ae852b0eeb485c8255bdaea8df7 SHA-1: 19568336dc0722d3e3b8eb247f1c411da8383b4c SHA-256: f1819bbb8cf19095d059e6b0dd233e97283196b83e655453a3c6a0f5cc5e58f1
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF containing embedded JavaScript, which is a common technique for delivering malicious payloads. Heuristics indicate it is part of a link farm pointing to compromised WordPress sites, suggesting an attempt to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious classification.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2947

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://novaserv.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b1bf7ee1c3e---puvewerutigugapu.pdf In PDF document text
    • http://anchor-m.com/js/upload/files/rezoxuretowejabapusavavi.pdfIn PDF document text
    • https://hopefor.today/wp-content/plugins/super-forms/uploads/php/files/be8c914f70ec9c080f5a3c8df28e180d/wexuzojukozasalogusobi.pdfIn PDF document text
    • https://lakeshoresmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/511g60ed642svgj2u3f038dhp2/21843393264.pdfIn PDF document text
    • https://advance-pack.com/editor_upload/file/41283408788.pdfIn PDF document text
    • https://dotcomtravelegypt.com/userfiles/files/fopitejategako.pdfIn PDF document text
    • http://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/46b9faa60be86447c630e98aa7ee1173/pasoxuparexomoni.pdfIn PDF document text
    • https://www.azulejositurry.com/wp-content/plugins/super-forms/uploads/php/files/09u1t2p5cc539ckip6rfqnq804/21447408635.pdfIn PDF document text
    • https://bringem.de/wp-content/plugins/super-forms/uploads/php/files/362ddbbddd6e9ffe76fb955a75508468/xuwupiwaxonabizijoxasej.pdfIn PDF document text
    • https://aldea.work/wp-content/plugins/super-forms/uploads/php/files/53b55ea913d1494191642b43a03c5f86/91636023822.pdfIn PDF document text
    • http://cu-hinothai.com/ckfinder/userfiles/files/13286273402.pdfIn PDF document text
    • http://khanaphatgroup.com/UserFiles/file/xidiroxokupefadutokegor.pdfIn PDF document text
    • https://www.bouwenaaneensterkwerkgeversmerk.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16087159c4340d---fumuxobo.pdfIn PDF document text
    • https://fier-forjat-valimet.ro/ckfinder/userfiles/files/82611008680.pdfIn PDF document text
    • https://minhvuongthuphap.com/upload/ck/files/nomedirip.pdfIn PDF document text
    • http://qwerty.pl/_data/file/12036946948.pdfIn PDF document text
    • https://www.pharmaright.ca/wp-content/plugins/super-forms/uploads/php/files/ju3abqpl2ifaposf2jdoc40a88/vemebepa.pdfIn PDF document text
    • https://artsketch.ru/wp-content/plugins/super-forms/uploads/php/files/63875ab9b962884a2fdd08d029b79a82/44089498104.pdfIn PDF document text
    • https://dcoderesearch.com/uploads/51972151038.pdfIn PDF document text
    • http://www.petersmetalstitching.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1606eedfde0a2b---ramirekabidarajegagudix.pdfIn PDF document text
    • http://test.uebersetzungen-nesselberger.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607cbd9750c61---24389187463.pdfIn PDF document text
    • https://sharidendesignasphalt.com/wp-content/plugins/super-forms/uploads/php/files/daf4ae9edef87b1b767d231e9ba36060/76855565166.pdfIn PDF document text
    • https://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/16075e3177313d---29225083422.pdfIn PDF document text
    • https://www.karavanlakesfet.com/wp-content/plugins/super-forms/uploads/php/files/0569cae2eabc9bb4c820a4a487d2154a/34906840094.pdfIn PDF document text
    • http://mrsgladysosei.com/clients/f/fd/fd76c46f75d01f7adbe86f52c2a5b8c1/File/76284908641.pdfIn PDF document text
    • http://monarchiaerembolt.hu/tmp/26787824308.pdfIn PDF document text
    • https://bda.ch/ckfinder/userfiles/files/kifiripiw.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=convert+10st+6lb+in+kgPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD3E9 10792 bytes
SHA-256: 1aec2185be10c9d80d8be280aba2de3f1c9dcb62136574e697a2fa7c1671d0af
font_01_sfnt_off0000ecfa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECFA 17340 bytes
SHA-256: 3f599930d8896696217d5210f8e71d168f165b9e498a31a9f51c942daa9dcd25

Open this report in the interactive analyzer, or submit your own file for analysis.