Malicious PDF — malware analysis report

Static analysis result for SHA-256 4205a3b19085cb2e…

MALICIOUS

PDF

66.8 KB Created: 2021-05-23 06:53:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe528ecc047259f961a36dcf067af2cd SHA-1: c193c183db071e4d82296bdf7bd628ac5ae49871 SHA-256: 4205a3b19085cb2e77e2eaa176437e8305220e77fdc5e19c8e6937d28280bcba
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains multiple embedded URLs pointing to compromised WordPress sites and disposable hosting, indicative of a link farm used for phishing or malware distribution. ClamAV detection and ML classification strongly suggest malicious intent, likely involving exploitation of PDF vulnerabilities to redirect the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8125

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/uplcv?utm_term=wiskunde+oefeningen+3de+leerjaar+pdf
    • http://krevue.cz/UserFiles/File/40161885477.pdf
    • http://esoftland.com/userfiles/file/bulizu.pdf
    • https://www.kunapak.com/wp-content/plugins/super-forms/uploads/php/files/aek4jf7kqdb9vhvcb7hklgril7/31384359367.pdf
    • https://www.numberoneporthill.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606d9737b5326---94213932552.pdf
    • http://aarogyamedico.com/userfiles/file/33150580631.pdf
    • https://www.mii.net/wp-content/plugins/super-forms/uploads/php/files/74f424966ebef1a8143bb83103e90525/73651041705.pdf
    • https://akdenizokullari.k12.tr/wp-content/plugins/super-forms/uploads/php/files/bfn12tku845s106upg7u1tef8e/38252458879.pdf
    • http://vasilii-orlov.fun/wp-content/plugins/super-forms/uploads/php/files/f250c8e29c580a2f3b652317e0f92cf1/rolonojululogitexik.pdf
    • https://fietenhaardenenkachels.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607aa7822d354---zigukaweda.pdf
    • https://evg-prague.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16079e1a2c4060---24483768448.pdf
    • http://www.majorisinvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609b66b913d34---80753139668.pdf
    • https://vigiweb.cl/dinamicos/files/file/jorakelok.pdf
    • http://vilaportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ca6dabb3a5---pagonesunegitunodo.pdf
    • https://claphamjunction.com.au/wp-content/plugins/super-forms/uploads/php/files/f09aca6deb16ee9bed37999a4eebbda7/xumuwijabujakamafikodabi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbe3.bin
9b930452c06759678af8f86802147c383175177afcecb699ce706718312a60cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBE3 5524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.