Malicious PDF — malware analysis report

Static analysis result for SHA-256 3771bfe12bc8a035…

MALICIOUS

PDF

127.7 KB Created: 2021-06-29 05:56:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 4d05e1a584167db5a7e38c51c7f23b9d SHA-1: dd1dfae5c3eb1b6d9b1089cc450db128c5cd2ac8 SHA-256: 3771bfe12bc8a035ab275ebaa87cc6a09aaa90d60560b1495c6d959d2dbc0b67
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is identified as a PDF containing a link farm, with multiple URLs pointing to compromised CMS upload storage. The ClamAV detection 'Pdf.Phishing.Trojan' strongly suggests a phishing or malware distribution intent. Although no scripts were directly extracted, the structure and URL patterns are indicative of a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier clean score 0.1873

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wisdomtours.net/upload/file/ronadadotowepodowa.pdf In PDF document text
    • https://www.paparazzirestaurant.com.au/wp-content/plugins/super-forms/uploads/php/files/5a39412fe98a6a75426a8b98e58aa5e5/pejurabojutivosapej.pdfIn PDF document text
    • http://drvision.org/wp-content/plugins/formcraft/file-upload/server/content/files/160c74f2d3e941---45851997090.pdfIn PDF document text
    • http://ccforum.kr/uploads/file/1622219832.pdfIn PDF document text
    • https://www.bouldersudbury.org/wp-content/plugins/formcraft/file-upload/server/content/files/160cd53955c5d9---kopito.pdfIn PDF document text
    • http://www.sunaryem.com.tr/wp-content/plugins/super-forms/uploads/php/files/hoe2mnvi41934ngl5pm82dp3e6/binezi.pdfIn PDF document text
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f012842830---danutemesozuzalonexat.pdfIn PDF document text
    • https://brod-plovdiv.com/images/54113278694.pdfIn PDF document text
    • https://chicagoportablexray.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cbae32a8b34---nokagodukijuluzuxuxazuz.pdfIn PDF document text
    • https://luxmarketing.agency/wp-content/plugins/super-forms/uploads/php/files/b2ph694njvbmn8ballq1qgl87n/74770964867.pdfIn PDF document text
    • https://artsketch.ru/wp-content/plugins/super-forms/uploads/php/files/a77c9e256b8bb012a5357ebb820c5459/38421976530.pdfIn PDF document text
    • http://webursitet.org/Files/file/perafedasegazomo.pdfIn PDF document text
    • https://acethamessecurity.co.uk/wp-content/plugins/super-forms/uploads/php/files/219ffb99213a1898f37148d6f149c563/60397108367.pdfIn PDF document text
    • http://aceonlinementors.com/userfiles/file/lozalapakewokewezisidev.pdfIn PDF document text
    • https://vetranhtuongmamnon.vn/wp-content/plugins/super-forms/uploads/php/files/hu5clgvdfn1pa1dh0dim5iannj/pazapezo.pdfIn PDF document text
    • http://adhdadvisory.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a8dc14745f0---56114974482.pdfIn PDF document text
    • http://mko-yug.ru/wp-content/plugins/super-forms/uploads/php/files/1dd6d292929d59c78467c86dcc5dd0c5/68150107308.pdfIn PDF document text
    • https://thriveelearning.com/wp-content/plugins/super-forms/uploads/php/files/8df020fd7e1f3523ad7911023c446298/tudubatufibojalimuxuvilaf.pdfIn PDF document text
    • http://www.rlktechniek.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160853ec770532---40131807083.pdfIn PDF document text
    • https://fastcomputer.vn/wp-content/plugins/super-forms/uploads/php/files/7e55545b4decfd5b458d5b1c7e5c2bdd/45410459946.pdfIn PDF document text
    • http://afgventuregroup.com/cfiles/file/xuvominubovo.pdfIn PDF document text
    • http://nanumed.ro/uploads/files/20884184720.pdfIn PDF document text
    • https://certifiedmoversinc.com/wp-content/plugins/super-forms/uploads/php/files/ad458c56d8ffc1f823644b03ffedf443/latisewiwufinuf.pdfIn PDF document text
    • http://whalesart.com/uploadfile/file///2021062501200968.pdfIn PDF document text
    • http://stark-tools.ru/images/uploaded/sinuxipub.pdfIn PDF document text
    • https://e-lightingcontrols.com/wp-content/plugins/super-forms/uploads/php/files/debcafcdccffd431cb0093f72d438b34/37496873444.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=ash+wednesday+church+servicePDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001aa63.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AA63 10552 bytes
SHA-256: e3928d048129fee040226aa8673efd0e06d16e508cdfd701b6a4c695ef8fc07a
font_01_sfnt_off0001c270.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C270 21136 bytes
SHA-256: 6b28f0cd9c35373dab0230a798e8fa7e9ae5393a4b1f9a38b1733473340f0d55

Open this report in the interactive analyzer, or submit your own file for analysis.