Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8e59ae45ec7bca2…

MALICIOUS

PDF

86.0 KB Created: 2021-06-29 11:47:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: a1b0e213df79de14bf2b9dcda017df1a SHA-1: e5bcdbd4f2b828224ca0981be3f80c6ebdc22f66 SHA-256: f8e59ae45ec7bca2f6e81e10a68b98db0a12a396eb133d6076c6cb7c6509d2b2
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as a phishing trojan by ClamAV. Static analysis revealed multiple heuristics indicating the PDF acts as a link farm, pointing to numerous disposable hosting sites and compromised WordPress uploads. These links are likely intended to redirect users to malicious sites for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3729

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crysiq.ru/uplcv?utm_term=wrath+of+me PDF link annotation
    • http://atlantichomeportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c340b518f00---57601075537.pdfIn PDF document text
    • https://oxi-dental.ro/imagini_ws/konivabimavajukagipirijet.pdfIn PDF document text
    • http://fsoa.cn/userfiles/file/12403620069.pdfIn PDF document text
    • https://ag-concept.ru/wp-content/plugins/super-forms/uploads/php/files/507dd4e31293036993774b1ee8c8d156/40795455779.pdfIn PDF document text
    • https://donnasalon.ru/wp-content/plugins/super-forms/uploads/php/files/2b3ad1bcd5cc62d3e45726b752617689/duvatitarel.pdfIn PDF document text
    • http://www.marcado.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160837e00a44e6---jifebixafimap.pdfIn PDF document text
    • https://abofahed.com/userfiles/file/88798814990.pdfIn PDF document text
    • http://fygl.net/uploads/file/170605316739.pdfIn PDF document text
    • http://akbmodel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac9434a3204---13812295271.pdfIn PDF document text
    • https://divorcioconsensual.com.br/wp-content/plugins/super-forms/uploads/php/files/76f7ece42bc4f4d4fd249b02043eb20d/xomopotetepojonizukafami.pdfIn PDF document text
    • http://www.meglobalinc.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160c854114c1cf---vikixaxibi.pdfIn PDF document text
    • http://bestforfishing.com/wp-content/plugins/super-forms/uploads/php/files/b05c77a0cda0a52e5607594f2d21b767/vakanexarefugo.pdfIn PDF document text
    • https://www.treehousecare.org/wp-content/plugins/formcraft/file-upload/server/content/files/160789f0b3123d---41719265863.pdfIn PDF document text
    • https://comfortinnbarrie.com/phpsites/vertical_living/uploads/file/zipitozifebufuwed.pdfIn PDF document text
    • http://pavcargo.ru/wp-content/plugins/super-forms/uploads/php/files/11778351e5d7b29a7014afa1861de9bc/gozopojowilanososib.pdfIn PDF document text
    • https://www.allterra.group/wp-content/plugins/super-forms/uploads/php/files/f9769a270f1282f7aa34e0d481760ec8/busuguzoxibozo.pdfIn PDF document text
    • http://sushi-belovo.ru/files/fivisebemaka.pdfIn PDF document text
    • https://www.pennlighting.com/wp-content/plugins/super-forms/uploads/php/files/5c283cc9d246963d93122c6e490f5c92/88960472453.pdfIn PDF document text
    • https://www.burit.net/wp-content/plugins/formcraft/file-upload/server/content/files/160abeb1e250ad---99000320827.pdfIn PDF document text
    • http://sukhabalka.com/files/file/59182787094.pdfIn PDF document text
    • http://www.skup.it/wp-content/plugins/formcraft/file-upload/server/content/files/16093fc722a66e---vezinomisepamepi.pdfIn PDF document text
    • https://jollytime.ru/wp-content/plugins/super-forms/uploads/php/files/c747f248f094f9971ae893cd05258464/30840259467.pdfIn PDF document text
    • http://thegreenlegacykeepers.com/clients/e/e8/e8dc17949b7ef813e9937e453902477f/File/lupijixojadefotiju.pdfIn PDF document text
    • https://oiweld.com/wp-content/plugins/super-forms/uploads/php/files/055a69621b214243ff00094f2b775662/toditogigomuwanomujo.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6ca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6CA 18072 bytes
SHA-256: 0f035af6bc4cf4bbe3dfd5ea5999afa07fa3f8c57df8aebd8ad523f250564986
font_01_sfnt_off0001254b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1254B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00013d62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13D62 10060 bytes
SHA-256: 681aa93bb651a126f2995d8c2c3b179cc4ee0f3bbdc67c30193c5c1039d53d60

Open this report in the interactive analyzer, or submit your own file for analysis.