Malicious PDF — malware analysis report

Static analysis result for SHA-256 33e1723d2cc14373…

MALICIOUS

PDF

66.7 KB Created: 2021-05-14 02:44:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 571305085b7bf544ab54f1de16462848 SHA-1: c2b48925c1255d71d601cee4bb2d4fca04f2802e SHA-256: 33e1723d2cc143731ebcf2d707b62a84ec3cba9e94dbe8df03179b1124e82386
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple links pointing to compromised WordPress sites, suggesting it's part of a link farm designed to distribute malicious content. The ClamAV detection and ML classifier indicate a high likelihood of malicious intent, specifically identified as a phishing trojan. The document body's text about 'busy accounting software free with crack' further supports a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7801

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://indacphuc.com/wp-content/plugins/super-forms/uploads/php/files/f5unpvsch22122mga79kqbp781/xakokutufolabimumo.pdf
    • https://hightechrustremovers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1606f67f9378ad---64136552887.pdf
    • https://cowichanseniors.ca/userfiles/file/duvajeferujega.pdf
    • https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/1607f8b180fd66---99305699351.pdf
    • http://lifemartrealestateconnect.com/wp-content/plugins/super-forms/uploads/php/files/5dt2bc1107tsjhpo8bp0te52q4/gevowatipazaritumipu.pdf
    • http://allegroescrow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608944b869512---66058589684.pdf
    • https://gamletaarnhuset.no/wp-content/plugins/formcraft/file-upload/server/content/files/160952b54157ba---xejesopadavag.pdf
    • https://stefandes.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075457d0eded---71367627485.pdf
    • http://chagatea.ru/wp-content/plugins/super-forms/uploads/php/files/6d9de8c4c6ae61aa1cebc3005997d76f/21837601018.pdf
    • http://bigband-ulm.de/userfiles/files/tutudetoluzir.pdf
    • http://es-umzuege-transporte.de/wp-content/plugins/super-forms/uploads/php/files/9bc9853db74ceac6fb12d4d49fa75368/11664143382.pdf
    • https://thealloywheelcentre.co.uk/wp-content/plugins/super-forms/uploads/php/files/2ca29f4cde6a0189cceeae9f4cab8ea9/69731368690.pdf
    • http://thefutureofgolf.eu/wp-content/plugins/formcraft/file-upload/server/content/files/16099327a76feb---71275510936.pdf
    • http://serendipityorlando.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e04e1cba19---dogawomimetemuzaxosapote.pdf
    • http://sh8ke.com/wp-content/plugins/formcraft/file-upload/server/content/files/160744b15c9e38---bobovewudosipasuseguze.pdf
    • http://admio.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160728de57ec3e---wenikesafigukujosikinileg.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=busy+accounting+software+free++with+crack
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dab3.bin
fc29c1b9be713d48137006ee5b8be2fd8763fd57aedd11a77cb143d16ca9f9fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDAB3 5300 bytes
font_01_sfnt_off0000ecbb.bin
e9a5a1f6ed95b1e3669933bb00002ad32a1708c3e0b735191cad5e02368a6c7d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECBB 1800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.