Malicious PDF — malware analysis report

Static analysis result for SHA-256 48fef73d48782798…

MALICIOUS

PDF

62.9 KB Created: 2021-06-03 02:46:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b2ad7bb1cf6a7a7a6f837c164adc7c1b SHA-1: ac320cbe7164c6a57179cc4152a5475bbe2a12ba SHA-256: 48fef73d48782798776e461388aa027e65eaf69f8d4ff96f20fd3ab5a65ce04c
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing and trojan threat. It functions as a link farm, presenting numerous URLs that likely lead to malicious downloads or further phishing attempts. The presence of multiple compromised CMS upload links suggests a tactic to host malicious content on seemingly legitimate but compromised websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8553

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/uplcv?utm_term=summertime+saga+19.5+save+file+download+android
    • http://aleeblog.com/wp-content/plugins/super-forms/uploads/php/files/670p6rtjuhoq5hdqj3sbpkmsp1/reluzedisinibejusekeliv.pdf
    • http://akssert.com/userfiles/files/47905784511.pdf
    • http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/160a65cf895095---8456757666.pdf
    • https://glbtrader.com/userfiles/file/60418201333.pdf
    • https://www.birdandwildlifeteam.com/wp-content/plugins/formcraft/file-upload/server/content/files/160abb72195515---wudogexufawoxewilariwogew.pdf
    • https://adm.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/9e1656ceb3afb54595334cd803315b87/70591353457.pdf
    • http://komputerzagrosze.pl/userfiles/file/kodebemakaxunopozijokot.pdf
    • https://blackknowledge.com/wp-content/plugins/super-forms/uploads/php/files/8e0b234d116fe2450583d7c088dd7824/35765016971.pdf
    • http://dmn.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160785e93e151f---genevelinemijutor.pdf
    • https://law.myvzl.com/wp-content/plugins/super-forms/uploads/php/files/u12ge1b74eftk77gmjlr6502nl/vusiwawegijevilodijaso.pdf
    • https://ancoraeducacion.com/images/37155634766.pdf
    • https://alshaabcoop.com/userfiles/file/56839759143.pdf
    • http://sad-azov.ru/wp-content/plugins/super-forms/uploads/php/files/3c5b9fc9f0fe1c5c87a440cc4e40b43a/90212934747.pdf
    • https://www.isnb.co.uk/wp-content/plugins/super-forms/uploads/php/files/a31cc9b925f936c7d67a7b08f011ea38/xirinimo.pdf
    • https://noihoithanhtuan.com/media/ftp/file/lomurivudun.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d791.bin
1eaf96fd47589c719d02140617a336ca06d91536573a61ad04285c9cde693f07		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD791 5848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.