Malicious PDF — malware analysis report

Static analysis result for SHA-256 3521ad20736d0fba…

MALICIOUS

PDF

85.5 KB Created: 2021-06-30 01:36:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 30183c0d9288f016310cf77f17468f8f SHA-1: 66c9e79b1909a8053dec8d5727ae360e72ff80b9 SHA-256: 3521ad20736d0fba6ea81d49f9fc8221b6dc364ef3378bc56c83385c1a8dec4e
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm pointing to multiple compromised WordPress sites, indicating a phishing or malware distribution attempt. The ClamAV detection and ML classifier further support its malicious nature. The document body is unreadable, but the heuristics and URLs strongly suggest a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5978

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://alfa-clining.ru/wp-content/plugins/super-forms/uploads/php/files/e2498c8ea2e70945f97b15591e50a21c/55809091688.pdf
    • https://wentworthre.com/wp-content/plugins/super-forms/uploads/php/files/42f227d66c8d89142e3c458db0ac6008/14537308855.pdf
    • https://reflexlighting.com/wp-content/plugins/super-forms/uploads/php/files/2e018a6c1c2aa13bb6ea7d685f3b29db/55063281255.pdf
    • https://gpagroup.in/wp-content/plugins/formcraft/file-upload/server/content/files/1607fe566059bb---kebarujarita.pdf
    • https://home18.ru/wp-content/plugins/super-forms/uploads/php/files/adc7ae40eeb4ab1821e763e97e516a5e/sivizuzalokof.pdf
    • https://rabudiagnostic.com/userfiles/files/bamowi.pdf
    • http://www.allatpatikapecs.hu/images/file/5702115880.pdf
    • https://scriptdd.com/_file/file/rogila.pdf
    • http://americansemitruckparts.com/d/files/98097058270.pdf
    • https://macleanpinesdrivingschool.com.au/wp-content/plugins/super-forms/uploads/php/files/3c749c441224dfe274bd4530c4739152/79446400734.pdf
    • http://smn68.com/clients/75339/File/90752292343.pdf
    • https://ipic.vn/userfiles/file/nuxexeno.pdf
    • https://christembassybarking.org/wp-content/plugins/super-forms/uploads/php/files/ea04b16ea467533022e67e4ffe2dfa22/41277454557.pdf
    • https://autoandtruckrepair.net/nbloom/fckuploads/file/getuxapogikew.pdf
    • http://for-rent-aalst.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ce4f425403---vudetifi.pdf
    • https://ahreco.com/uploads/news_file/tadakifusowisixexov.pdf
    • https://halobysciton.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609771a9e6f0d---duwojepeguse.pdf
    • https://travels-ukraine.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c0daf027dd8---nalikajesoxosud.pdf
    • http://cityhelps.org/clients/6/61/61afa7a028a8e04f14432b0fece6f2b0/File/56690342389.pdf
    • http://omonetach.pl/foto/ilustracje/file/66253345417.pdf
    • http://www.sandzthabapanel.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160b634a6d2212---zinavijid.pdf
    • https://afriqueitnews.com/wp-content/plugins/super-forms/uploads/php/files/11089522760eaad476f6ef5ad4a68c5e/26294524716.pdf
    • http://rayzerfamilyreunion.com/clients/0/08/08e2d5bcffca37c2e1a82d364f4296c6/File/jumiz.pdf
    • http://toyotarent.kr/FileData/ckfinder/files/20210616_70265EFFC545B072.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/zMnd8XtcwSM/uplcv?utm_term=in+the+latter+meaning
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012d37.bin
2bd398f14ed15bc1717ba788f6add43899fc4afd026388b274c820d8250c63b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D37 19304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.