Malicious PDF — malware analysis report

Static analysis result for SHA-256 48ddfcf2803f8d07…

MALICIOUS

PDF

85.5 KB Created: 2021-07-18 14:20:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-15
MD5: 525168b2452bd9e266d94ebdcc0cf01b SHA-1: c28d9c809754b45e9c94951ec5a62fbe7ecfd38c SHA-256: 48ddfcf2803f8d07ce1df953528a2d31971ca91779979c4e59d2ef16ca605a8a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous external links, many of which point to compromised WordPress upload directories, suggesting a phishing or malicious redirection scheme. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution via these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fultoys.com/userfiles/29562242997.pdf In PDF document text
    • http://vytvarnyobchod.cz/UserFiles/File/40419366102.pdfIn PDF document text
    • https://apz-arte.com/ckfinder/userfiles/files/xuponudaz.pdfIn PDF document text
    • http://heritagecarletonplace.com/clients/c/c2/c23aa4fb54f25340752d20cfcff880b2/File/2128882606.pdfIn PDF document text
    • http://bulk-supplies.com/userfiles/file/25822364725.pdfIn PDF document text
    • http://pappteam.hu/userfiles/file/vomufagati.pdfIn PDF document text
    • http://highlandcougars83.com/clients/2/26/268573c5102cd00412bac87cee9346ec/File/32442735983.pdfIn PDF document text
    • http://sciencevier.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f1ce37d7f9d---javaxerabivojiv.pdfIn PDF document text
    • https://contactfm.be/userfiles/files/levijopidugosewisar.pdfIn PDF document text
    • https://lesartsdansmonjardin.com/userfiles/file/20210608162650.pdfIn PDF document text
    • http://asalsold.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c36be84a87e---4520731534.pdfIn PDF document text
    • https://erdemlerkoleji.com/resimler/files/85445489390.pdfIn PDF document text
    • http://apelasyon.com/img/userfiles/files/zozogil.pdfIn PDF document text
    • http://soflocops.com/clients/67403/File/41765921751.pdfIn PDF document text
    • https://bizdrive.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/160ad91769092e---keribid.pdfIn PDF document text
    • http://gardnersunited.com/clients/e/eb/eb3320446930dd457027df34457c622b/File/genosasajerexo.pdfIn PDF document text
    • http://westmoorclassof1965.com/clients/5/52/52ec68f2b927accf75267cb07bfcc891/File/61878423427.pdfIn PDF document text
    • https://hoffmanowska.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16081b14b45fe4---gibolejikuvurowab.pdfIn PDF document text
    • http://aeskulap24h.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b409af32ac9---72916164186.pdfIn PDF document text
    • https://www.helpforbusymums.com/wp-content/plugins/super-forms/uploads/php/files/0b727f622d9cf6efde91ceb2fe4770f5/99554813375.pdfIn PDF document text
    • http://bbdecontra.com/userfiles/files/62324066584.pdfIn PDF document text
    • http://plusbateria.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081209c57482---93747361458.pdfIn PDF document text
    • https://www.taxikladis.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160b453bb61e79---57702722187.pdfIn PDF document text
    • http://www.driftime.ee/wp-content/plugins/formcraft/file-upload/server/content/files/1609289d5db549---88719869255.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=one+light+year+from+earthPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec91.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC91 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off000104a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104A3 16944 bytes
SHA-256: ec9f917f9d231f85a0433eb3348dd0d2f8fdcbc7f6e7e5177a1ce4101b677503
font_02_sfnt_off000130fb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x130FB 10632 bytes
SHA-256: a6c374cd445e77e1c50cd26428cdc90083c8e768492cbee90a4c41efb69bbfa4

Open this report in the interactive analyzer, or submit your own file for analysis.