Malicious PDF — malware analysis report

Static analysis result for SHA-256 48bddcb549fab633…

MALICIOUS

PDF

63.7 KB Created: 2021-05-18 02:44:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 90dca31fd3198d6dfa4d015666bf42d9 SHA-1: 5a21e544f6d8e61130a7228c982df6c3c9651029 SHA-256: 48bddcb549fab633b0f004381b8163e1a66ce5679e77a329e5b6ea40252104c6
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links pointing to compromised WordPress sites, which in turn host other PDF files. This structure suggests a link farm designed to distribute malicious content or facilitate phishing. The ML classifier also flagged this PDF as malicious, supporting this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8201

Heuristics 4

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://juniorsmagazine.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c4aa5665c1---28658868504.pdf
    • https://home18.ru/wp-content/plugins/super-forms/uploads/php/files/9ce5b4172bf9648c9852d18ab2989197/81006459286.pdf
    • http://www.iso-clean.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16075d3129837e---4128394146.pdf
    • https://lcd96.ru/wp-content/plugins/super-forms/uploads/php/files/7bf7bd087db78449b3aed4c6c89321fb/dumip.pdf
    • http://audiencefertilization.com/fckeditor/editor/filemanager/connectors/php/userfiles/file/gunetiwi.pdf
    • https://lorenzonimmigrationlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d988f485d8---89755610827.pdf
    • http://www.dadosefatos.net.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607de05f40765---76766099849.pdf
    • https://www.histoiresdegroupes.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071709256430---risitapajis.pdf
    • https://winston-woodward.com/wp-content/plugins/super-forms/uploads/php/files/2e58b85074c393245726b6bac97e5ad5/37033220701.pdf
    • https://www.kngroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a1d8bba3196---vevomo.pdf
    • http://computerdoki.hu/user/file/51175418200.pdf
    • http://dossalas.com/wp-content/plugins/super-forms/uploads/php/files/61099ae0fd354179e81898559d4e5a9b/71556129823.pdf
    • http://trackeg.com/en/wp-content/plugins/formcraft/file-upload/server/content/files/16088642d0358f---69837142042.pdf
    • https://www.brightfieldbusinesshub.co.uk/wp-content/plugins/super-forms/uploads/php/files/f7vspcbm330u86mn7n1cjhviaf/86982407224.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=present+perfect+continuous+tense+exercises+for+grade+5
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e6bf.bin
c638537fdf33505475307f822f3053c203762671fcec8c6ede867ef612fde350		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE6BF 5364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.