Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c48e64ad9de5f2b…

MALICIOUS

PDF

79.0 KB Created: 2021-04-29 07:23:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4cfdc1a19cbbfa429e8c72a12e21325e SHA-1: a49b8624147ff5035a472c133eeb0b06bc0f931a SHA-256: 2c48e64ad9de5f2b3f0b3cb0f59428f549518d6a308209825e0f0e203e5237df
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple links pointing to compromised WordPress sites, suggesting a link farm designed to distribute malicious content. The ClamAV detection and ML classifier indicate a high likelihood of malicious intent, specifically identified as a phishing trojan. Although no scripts were directly extracted, the PDF structure and embedded links strongly suggest it's part of a phishing campaign, likely using embedded JavaScript to facilitate redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6870

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xn--90ad5ackt1d.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/68d9c6768b6e6718194a2b4ec202a562/84541784389.pdf
    • http://associacaoguainumbi.org.br/wp/wp-content/plugins/formcraft/file-upload/server/content/files/16078c621a62c3---xagedikogexofiwu.pdf
    • http://www.cheapmotorcycleinsurancepa.com/wp-content/plugins/super-forms/uploads/php/files/5p1n97325tcpn9ci8o5vj1ldd6/komogekizedupe.pdf
    • https://thesmithgrouphouston.com/wp-content/plugins/super-forms/uploads/php/files/0e2a64c0aa22dae821461bc8080739a5/demegonopejefuwapu.pdf
    • http://trackeg.com/en/wp-content/plugins/formcraft/file-upload/server/content/files/1606cbfaf0f075---53585759942.pdf
    • https://ludifrance.fr/userfiles/file/26151157816.pdf
    • https://njsolarpower.com/wp-content/plugins/super-forms/uploads/php/files/c70c2172c835832975e1c4fc4ae15186/pegisi.pdf
    • https://proff-doors.ru/wp-content/plugins/super-forms/uploads/php/files/45df772be26216ae3538b2a632b93e08/74420630612.pdf
    • https://sipsib.ru/wp-content/plugins/super-forms/uploads/php/files/bc5da6bd0adf69e020b8316fe8ca2e29/ramusugikod.pdf
    • http://steclotildehorton.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607a459114c59---tusemefavage.pdf
    • http://evabody.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160883fc099901---jogefojapagar.pdf
    • http://asu.com.vn/wp-content/plugins/super-forms/uploads/php/files/gvfp3ekq68vmuvtf3pirikfsu5/libanigoxavapo.pdf
    • http://www.tif.cn/wp-content/plugins/super-forms/uploads/php/files/om9bsfrs0c43c0qdbkv7omq99r/25145657989.pdf
    • https://www.lorenzofranzone.it/wp-content/plugins/super-forms/uploads/php/files/e90180c8c9282367acf5d946642a68c3/81993832216.pdf
    • http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160717e93ae35b---63587030892.pdf
    • http://www.saraviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072b3dea7e14---34592308198.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/DOqCt-cVA4I/uplcv?utm_term=national+lampoon%2527+s+vegas+vacation+parents+guide
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010115.bin
687c0d34549cc4f7e4c71b928edbfdee0c4b207bfba5e41c5452cb8371da2bf7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10115 5456 bytes
font_01_sfnt_off000113a2.bin
31bde7f27facf39166b79566c2e4e79ce5a25b147ef87d7520504e19b225e918		 pdf-font-stream PDF embedded font (sfnt) at offset 0x113A2 11300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.