Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c4fb0163060ecdc…

MALICIOUS

PDF

69.4 KB Created: 2021-06-12 03:07:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b230d951928fe2ac49b50f44af026186 SHA-1: 3b7d02dfa3e233246ad314f5972e841140db2ea6 SHA-256: 2c4fb0163060ecdcf25656e3b9aedab6772cd212e2d25709329485ca419fc0ac
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links to external websites, many of which appear to be compromised CMS uploads or disposable hosting, suggesting a link farm designed to distribute malware. The presence of a ClamAV detection for 'Pdf.Phishing.Trojan' and ML classifier flagging further supports malicious intent. The document body, though heavily obfuscated, contains references to 'Zuma revenge deluxe free download full version', indicating a lure for potentially unwanted software.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8239

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/uplcv?utm_term=zuma+revenge+deluxe+free+download+full+version
    • https://songhong.info/userfiles/file/46467742328.pdf
    • http://www.hj-bouwt.be/wp-content/plugins/formcraft/file-upload/server/content/files/160ab89dbbb97b---takezugofesaxovabojus.pdf
    • https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/55b2803ba81800269fd527c00f0173e9/jedirixawudip.pdf
    • https://foulardfotografando.it/file/17275941068.pdf
    • http://ibshop.gr/uploads/_uploads/files/tinozalininowaporavemokom.pdf
    • https://agilitynd.com/wp-content/plugins/super-forms/uploads/php/files/cd0a85147ac353a10099fc1b282a9c2b/26812174302.pdf
    • https://www.sblending.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160a38b20bd611---funidukadag.pdf
    • http://rethabise.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16085b47800ce7---85088281868.pdf
    • http://xn--42-6kcdlkbomh7beggito5p.xn--p1ai/userfiles/file/79200726701.pdf
    • https://senzedigicraft.com/wp-content/plugins/super-forms/uploads/php/files/3d9d2518da67f46f1079018654c73bf8/bekajajo.pdf
    • http://www.advokat.com/app/webroot/img/fck/file/16189630973.pdf
    • http://www.mondzorgvesa-voorschoten.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16088ceb84890a---remadotoravubozekefikote.pdf
    • https://brandonsmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/huv84ntimh5b3j763206iu0g82/84119436515.pdf
    • http://www.myhhsi.com/wp-content/plugins/super-forms/uploads/php/files/e2e2611e02e0c59aec97bf9273023417/mekepalinufilivabuban.pdf
    • https://flylights.pl/wp-content/plugins/super-forms/uploads/php/files/jqtt194uu0ihimp6fso4uv7vmf/21824333548.pdf
    • http://diysmart.net/userfiles/file/44800814999.pdf
    • https://acrgroup.nl/userfiles/file/digukabafepodifikakoj.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e31e.bin
969b6fcf15c8b88992ef748d5a90490f61d9a59a093945da763d50415a8129c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE31E 5404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.