Malicious PDF — malware analysis report

Static analysis result for SHA-256 210ae13af192b8dc…

MALICIOUS

PDF

68.1 KB Created: 2021-05-23 21:49:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 804eb3c768722ecc748c7a8c8fa9a568 SHA-1: 4616231a328608c8af04c06b64a133bac26e3a35 SHA-256: 210ae13af192b8dc7d6e0304e85afc203a81ca94e29b8d7efb55ff2a3b7df08f
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple links pointing to compromised WordPress sites, likely as part of a link farm to obscure the final destination. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically phishing. The document body, though heavily obfuscated, suggests a lure related to account activation, further supporting a phishing attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9959

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/uplcv?utm_term=how+to+activate+uan+without+pf+number
    • https://g3az.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081941b30e38---85680042330.pdf
    • http://www.mtpartnersfl.com/wp-content/plugins/formcraft/file-upload/server/content/files/16085e9381dff7---71633011630.pdf
    • https://accuratesearch.com/userfiles/file/21768863879.pdf
    • https://carstenrath.com/wp-content/plugins/super-forms/uploads/php/files/p02nopp7kqrb0dltubvpkfoqnf/kujilojut.pdf
    • https://cremeconferences.com/wp-content/plugins/super-forms/uploads/php/files/4110412075732dbd72c74d9362a18996/nixeretuleleso.pdf
    • http://counterreaction.net/wp-content/plugins/formcraft/file-upload/server/content/files/16081914a41965---damuxezef.pdf
    • http://www.akutrans.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a527f007edb---rapiwemitiwapunizez.pdf
    • https://afriqueitnews.com/wp-content/plugins/super-forms/uploads/php/files/b9e17bf34f426f2b6a54fbba58320fa2/84275493903.pdf
    • https://luxartparquet.com/wp-content/plugins/super-forms/uploads/php/files/102eba3f684ba9ebd294f42ae5612a9e/vegaxozorafo.pdf
    • https://www.goldenplanet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1608bee57c6211---zekovobemunesijejixex.pdf
    • https://thesmithgrouphouston.com/wp-content/plugins/super-forms/uploads/php/files/40a079aa8ec3a9ed2a5f7362946909c0/munek.pdf
    • https://www.synergyheart2heart.team/wp-content/plugins/super-forms/uploads/php/files/nbpahkknteul3jmdsnnougg6bl/vusozifujubub.pdf
    • https://gaseg.com/wp-content/plugins/super-forms/uploads/php/files/qnfcgrfn724lbdqt2kc5ekmu28/21578019459.pdf
    • https://www.albispanaderia.com/wp-content/plugins/super-forms/uploads/php/files/a39dcc788ae5f66ca34449b4e125ee17/tupegabu.pdf
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080fd766331f---22236381865.pdf
    • https://advancedbusiness.co/wp-content/plugins/super-forms/uploads/php/files/27c1649d52783372c4c72689e5a81f01/25978847240.pdf
    • http://www.hollyskauaicondo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160772b97b8c65---xivajibekeb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd08.bin
f6198dd968e763415f8f796cf20c7a95c7a11bc8e7f03fa80c2ce41a6a8f7e8a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD08 5180 bytes
font_01_sfnt_off0000ee85.bin
c9826e86370c55a351e1fbd93c7034b29e82b35df736a1c05d1d0cf6fcd87ce4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE85 10552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.