Malicious PDF — malware analysis report

Static analysis result for SHA-256 05421ac8e3f235f2…

MALICIOUS

PDF

288.9 KB Created: 2021-07-01 18:24:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-29
MD5: ca84d5af490e2f6f624f17583be5b882 SHA-1: beaab6b1a54a46685ddda56093be6e5cab03f575 SHA-256: 05421ac8e3f235f2720a737d6b9ef4c195007393fea391d49968e38bbc1bdc45
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains numerous links pointing to compromised WordPress upload directories, suggesting it's part of a phishing campaign to distribute further malware. The presence of these links and the overall detection score strongly indicate a malicious document designed to trick users into downloading harmful files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9124

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://moma-restaurant.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4e660cfa70---zeworaxibafaba.pdf In PDF document text
    • http://liburnia.pl/userfiles/file/vamibibuzikujo.pdfIn PDF document text
    • https://www.okcfarmersmarket.com/wp-content/plugins/super-forms/uploads/php/files/e69592124fca25550599256a7ffc4774/labagapikowowil.pdfIn PDF document text
    • https://kindliving.org/wp-content/plugins/super-forms/uploads/php/files/tmp/98255386398.pdfIn PDF document text
    • https://thriveelearning.com/wp-content/plugins/super-forms/uploads/php/files/2f7452f07d081b1cf1ca9f3fa8cf2ea4/gofexaxerufu.pdfIn PDF document text
    • https://sacc-la-chaux-de-fonds.ch/fichiers/file/sovelonu.pdfIn PDF document text
    • http://metzpaintings.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c94d4b36b9---dawaborevixumomidetoxuw.pdfIn PDF document text
    • http://vandientuchinhhang.com/upload/files/wavaxivoreja.pdfIn PDF document text
    • https://www.hinogas.com/wp-content/plugins/super-forms/uploads/php/files/site3s4r2ofqjf44elijn6fu35/menatudisekejiwe.pdfIn PDF document text
    • https://www.femregenx.co.za/wp-content/plugins/super-forms/uploads/php/files/d38n0hfetssun5i2m2oedteq4n/91523915652.pdfIn PDF document text
    • https://luxurytravel-show.com/wp-content/plugins/super-forms/uploads/php/files/da13722fe15dce3231b5abb03acaf7af/79188173775.pdfIn PDF document text
    • http://adance0112.com/upfile/editor/file/sawerek.pdfIn PDF document text
    • https://irantruck.ir/data/file/rudowagusizukuwijebew.pdfIn PDF document text
    • http://www.theflightfest.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ce2d225984---gepuni.pdfIn PDF document text
    • http://theettiaresottawa.com/clients/e/e8/e8f54e69a7463df9fd0adff13cd8e90f/File/nisinabenaladavar.pdfIn PDF document text
    • https://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/a4bfd75d8eb4f11a6d067ed142f49b21/93919089740.pdfIn PDF document text
    • https://spherule.org/wp-content/plugins/super-forms/uploads/php/files/685d6af1ae7ed0a38485e318c4c6222c/runitinusezawes.pdfIn PDF document text
    • https://www.webplease.it/wp-content/plugins/super-forms/uploads/php/files/7f27mamp8h3p5ul5an91hijhjb/90915816132.pdfIn PDF document text
    • http://evabody.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160806f283183d---39396078765.pdfIn PDF document text
    • https://kfz-gutachter-oliver-schiller.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607744530de55---mibojipa.pdfIn PDF document text
    • http://claudiodauelsberg.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609ba9357e3d4---jonarevoxujede.pdfIn PDF document text
    • http://inspirationallabels.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160dcb80c86ec5---nevozu.pdfIn PDF document text
    • https://kvgrup.com.ua/wp-content/plugins/formcraft/file-upload/server/content/files/1609493ee949d4---ximodupijido.pdfIn PDF document text
    • http://global-poseg.com/wp-content/plugins/formcraft/file-upload/server/content/files/160af86788d437---89011601723.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/zMnd8XtcwSM/uplcv?utm_term=streaming+one+piece+epsPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00030790.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30790 16632 bytes
SHA-256: 680e586a1ee573e661d30ea0f7a97a8805d5b79b2e3d5282e6cd27ea8e1e9edb

Open this report in the interactive analyzer, or submit your own file for analysis.