Malicious PDF — malware analysis report

Static analysis result for SHA-256 1252c8f360b62b07…

MALICIOUS

PDF

293.2 KB Created: 2021-07-07 11:23:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: abf66a64cd8bce15f15d8bcf640a463c SHA-1: 71c8d2dda269529fc82c128ae0331fa61059fcce SHA-256: 1252c8f360b62b07bc79e885d772c2bc93b26be2de5cc8948f63bbeed419cb58
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains numerous embedded URLs, with a significant number pointing to compromised WordPress upload directories, suggesting a link farm designed to redirect users to malicious content. The primary attack pattern involves tricking users into clicking these links, likely leading to phishing pages or further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7135

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sghscsjamarai.org/guruhargobind/userfiles/file/67423839685.pdf In PDF document text
    • http://cuatro-pr.org/sites/default/files/file/97977889409.pdfIn PDF document text
    • https://kodcomputers.ro/2664/uploads/jixeloludesalewadoko.pdfIn PDF document text
    • http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16091b51137274---waxozakesagez.pdfIn PDF document text
    • https://upchealth.net/wp-content/plugins/super-forms/uploads/php/files/33c7adc5f88ce73d5537530b5fc741c6/13803167598.pdfIn PDF document text
    • https://ecomassage.pt/wp-content/plugins/super-forms/uploads/php/files/m0kvencfb3r87uei260mmh00sn/71639669243.pdfIn PDF document text
    • https://tramtron.vn/uploads/files/files/5528668458.pdfIn PDF document text
    • http://raunlarose.us/wp-content/plugins/formcraft/file-upload/server/content/files/160b6f7c16d25b---51475454406.pdfIn PDF document text
    • http://sl-light.ru/design/img/upload/file/togulowom.pdfIn PDF document text
    • http://pcmcpropertyblog.com/wp-content/plugins/super-forms/uploads/php/files/1490b8c86f8815dc7c8b770e99ffaaac/98779597085.pdfIn PDF document text
    • http://winkeleninzundert.nl/uploadimages/files/78279115538.pdfIn PDF document text
    • http://www.lnk-creation.fr/upload/file/20857053850.pdfIn PDF document text
    • https://www.andrecampbell.ca/wp-content/plugins/super-forms/uploads/php/files/9f9a38fc45034e937d3cd81d5fcbe445/tubuso.pdfIn PDF document text
    • http://kulturazebrak.cz/userfiles/setovapiwepaxokuwuvebi.pdfIn PDF document text
    • http://crmrealty360degree.in/userfiles/file/jugazawogimunuwominuv.pdfIn PDF document text
    • https://0900107678.com/upload/file/famisidarilagor.pdfIn PDF document text
    • http://dodici12.ru/wp-content/plugins/super-forms/uploads/php/files/oss7r3t9jmdbonvkqblvbffn60/88213257499.pdfIn PDF document text
    • https://worldkelo.com/wp-content/plugins/super-forms/uploads/php/files/5bb97380950eb3033b3947c4dcddd4cc/dekimigikakemekuvobexabuw.pdfIn PDF document text
    • https://flvirginia.com/wp-content/plugins/super-forms/uploads/php/files/f2fe456c43318a1612976b4431918eed/27803032577.pdfIn PDF document text
    • http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/cc0i6t0ceglqb6qkpj44bmh9r3/80380912585.pdfIn PDF document text
    • https://www.modianodesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/16085607ea73b3---44983142762.pdfIn PDF document text
    • https://oiweld.com/wp-content/plugins/super-forms/uploads/php/files/65aaec14eb07e45b2c546eb0eec78b03/53844501644.pdfIn PDF document text
    • http://x04ydivan.ru/userfiles/file/14116654777.pdfIn PDF document text
    • http://densayhongngoai.com/uploads/userfiles/file/foruxanoximi.pdfIn PDF document text
    • http://www.gaviprintpack.com/wp-content/plugins/formcraft/file-upload/server/content/files/160841637cdcd2---duxunu.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/DOqCt-cVA4I/uplcv?utm_term=vaccines+calling+the+shots+worksheetPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000432ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x432EE 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00044b00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x44B00 18828 bytes
SHA-256: f4417fd1f45da3315c3abe0e33b0d6bfcab20312e755f39cc78d3638c6129a39
font_02_sfnt_off00047cf5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x47CF5 16752 bytes
SHA-256: 7c1a8eb0b9c23cf203c969b5d5d5631f8eb4ae760335902abb309347e0b2a7e8

Open this report in the interactive analyzer, or submit your own file for analysis.