Malicious PDF — malware analysis report

Static analysis result for SHA-256 0adf009e6248b085…

MALICIOUS

PDF

62.4 KB Created: 2021-05-28 08:05:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 17208165e1ac39472b0507e166264fbd SHA-1: 7fd647a6c63baea16668479f9bf8f0daf71b3a08 SHA-256: 0adf009e6248b0854a21ddc26feea19ca9e8f5c5833986df720230b9804c8cbf
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a link farm pointing to compromised WordPress upload storage, suggesting it is part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains metadata related to PDF creation and a URL that appears to be a lure for downloading content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8123

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://e-lightingcontrols.com/wp-content/plugins/super-forms/uploads/php/files/f8724539624442f84eb89cb94bc245f1/jesig.pdf
    • https://edukiya.com/wp-content/plugins/super-forms/uploads/php/files/66f085ec65ee308a27ebcc520a4d0083/22753523761.pdf
    • http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/160a72cfc65405---94688162530.pdf
    • http://halvani.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a6f45434a73---serenamodufimeradil.pdf
    • https://artbynela.com/uploads/file/fotapomomevekil.pdf
    • https://www.avenueroadadvertising.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b07504cbe93---nubunajire.pdf
    • https://eclipsetheaters.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609878bf50ca2---xajojete.pdf
    • https://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608029b6bbe57---pukobikipawiguxekija.pdf
    • https://micast.de/wp-content/plugins/super-forms/uploads/php/files/jfcstetllo3ua9sr6ekv90l90j/beniwisiwutabotipifiku.pdf
    • http://accurateverdicts.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a5bb5d0475---zazegadaburapulo.pdf
    • https://fullhousetourism.com/UploadFiles/file/20210525051241192.pdf
    • http://parkwestresidences.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609495e487f0b---luxopuxegokibiw.pdf
    • http://averon.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16076119ec34a4---26471628435.pdf
    • https://jfefood.com/wp-content/plugins/super-forms/uploads/php/files/11a8e52c0676782b7c363e4840e5a6ce/3197258223.pdf
    • http://www.holzbau-hoelzl.at/wp-content/plugins/formcraft/file-upload/server/content/files/160795ae5f15ad---tufife.pdf
    • https://certifiedmoversinc.com/wp-content/plugins/super-forms/uploads/php/files/8a463822b58a4b033d04dee2b5432264/64131787725.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/LPIa9PGmDLg/uplcv?utm_term=how+to+download+windows+10+video+editor
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7ed.bin
f2f03bcedf4eefae9f907e3650014a2a3ec22a88f59d4b4098b922d876ef4834		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD7ED 5124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.