Malicious PDF — malware analysis report

Static analysis result for SHA-256 f72999f9ab7b1757…

MALICIOUS

PDF

78.1 KB Created: 2021-07-18 19:35:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 13d549a6d3509bfd9737ffe4744bde23 SHA-1: e8f4f939f71f16f1af065623fd1fbf69cbc1ccec SHA-256: f72999f9ab7b1757a60b4e89644672495f8da4d7ce2d6ad6c8fb1bf20afb6e30
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as malicious by ClamAV and an ML classifier, and heuristics indicate it functions as a link farm. Multiple URLs point to compromised CMS upload directories, suggesting a distribution point for further malicious content or phishing lures. The PDF structure and numerous external links are consistent with a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5306

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://travelselection.us/wp-content/plugins/formcraft/file-upload/server/content/files/16088eccc5326d---kitiren.pdf In PDF document text
    • http://www.catalogodecineargentino.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c8680de618a---42800786631.pdfIn PDF document text
    • https://dentinale.eu/wp-content/plugins/super-forms/uploads/php/files/e44c195e31e60f87a58d9624373337db/wanowovuratetaso.pdfIn PDF document text
    • http://box8websites.com/ckfinder/userfiles/files/tofaliwaji.pdfIn PDF document text
    • https://newat.ru/wp-content/plugins/super-forms/uploads/php/files/64bf67e910df4236061f43c257a7f6c4/giwivo.pdfIn PDF document text
    • https://www.landalastadservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c0886665aa6---75934125902.pdfIn PDF document text
    • http://www.acefence.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084cfa71ddff---zalinewivimemoporimuvuzix.pdfIn PDF document text
    • https://photographerin.agency/wp-content/plugins/super-forms/uploads/php/files/s2ankp2arc5mng5bn2n8i9mq03/11537794733.pdfIn PDF document text
    • https://donnasalon.ru/wp-content/plugins/super-forms/uploads/php/files/d4bdf1b87825dee7862f8794c01d1534/30956361608.pdfIn PDF document text
    • http://happinessgown.com/upload/users/files/fugolikozaviwofexa.pdfIn PDF document text
    • https://www.colegiodesafio.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/160ac9a1559bcd---lunifejijofifazesajijaj.pdfIn PDF document text
    • https://higher-reason.com/wp-content/plugins/super-forms/uploads/php/files/c187iguj9na1a54a47gq7enu2m/67068556949.pdfIn PDF document text
    • http://wmc21.com/ckupload/files/zonixodokofujodala.pdfIn PDF document text
    • https://suemsas.com/wp-content/plugins/super-forms/uploads/php/files/6s7jbbftn7nd0uss8m8k23djl6/sufarafituruta.pdfIn PDF document text
    • https://cashofferoregon.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c74655cb815---53133130549.pdfIn PDF document text
    • https://sweetestspaparty.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084e1d61445e---nazanixuru.pdfIn PDF document text
    • https://techson-cctv.com/upload/file/30665651125.pdfIn PDF document text
    • http://becro-plast.hr/wp-content/plugins/formcraft/file-upload/server/content/files/160a025b19a504---xenolewawubo.pdfIn PDF document text
    • http://www.leesii.com/wp-content/plugins/formcraft/file-upload/server/content/files/160799e0741f22---8090046458.pdfIn PDF document text
    • https://extremetour74.ru/wp-content/plugins/super-forms/uploads/php/files/0f8ae34dde1f318e8934d03150ad370b/49879884815.pdfIn PDF document text
    • http://nuyewpilot.academy/wp-content/plugins/super-forms/uploads/php/files/c72d8ed1d41d969649ee919a5495fff4/vepal.pdfIn PDF document text
    • http://elmiraclassiccountry.com/wp-content/plugins/super-forms/uploads/php/files/dvb7e132pi21ihmhpov410i042/sunakogufekiraniwegi.pdfIn PDF document text
    • https://cremyco.com/app/webroot/docs/file/tovufojorino.pdfIn PDF document text
    • http://myphamasia.net/upload/files/nerapixubibimafotiwidepa.pdfIn PDF document text
    • https://digireg.com/upload/15162459102.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=secured+and+unsecured+creditPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f513.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF513 17060 bytes
SHA-256: fd8b3dda375f56bedf02e10cc4ab8ae7729f14ca9004ac395d15e6eb33437584
font_01_sfnt_off00012183.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12183 10372 bytes
SHA-256: d1443f9f3a5c4b4c9ecfe1fd98729392a1f8299be19adbd2c0258c48216abac7

Open this report in the interactive analyzer, or submit your own file for analysis.