Malicious PDF — malware analysis report

Static analysis result for SHA-256 4bcdfad62b1f32f6…

MALICIOUS

PDF

63.8 KB Created: 2021-05-11 11:50:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a2f9ff8dd6d42cd4fd63c79f1a17a53f SHA-1: b0e143efb80c0ea3846061669097d6ac0fa96815 SHA-256: 4bcdfad62b1f32f62d827300cacb5789b9f914cb1cc96c2c4461a55ae7c6c8fe
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was identified as malicious by ClamAV and an ML classifier, indicating a phishing or malware distribution intent. It functions as a link farm, with numerous embedded URLs pointing to compromised WordPress sites hosting PDF files. These links likely serve as a lure to download further malicious content or redirect users to phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8681

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://spherule.org/wp-content/plugins/super-forms/uploads/php/files/93ce46cd98317bf22bc6dafeec3f306a/4533153085.pdf
    • https://rescue.bg/wp-content/plugins/formcraft/file-upload/server/content/files/16095882a2c54d---wesiminumatenekepe.pdf
    • https://www.reachcast.ca/wp-content/plugins/super-forms/uploads/php/files/a3106ac61e39486c46b9fbce8394ec6a/sokekuf.pdf
    • https://heritagelogs.com/wp-content/plugins/super-forms/uploads/php/files/e2rjj2uvheigjb8g54a70lbm62/rovufafezepu.pdf
    • https://bbensonmft.com/wp-content/plugins/super-forms/uploads/php/files/c4bae3c0a22819f978fe1171c62fea52/situwebesemubima.pdf
    • https://qualitylightsolutions.com/wp-content/plugins/super-forms/uploads/php/files/712242470ef2d2a166a00f15b01c9e53/35493886678.pdf
    • https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/khcu3q24gbggr50eni1mahvc6i/wetilaxidoragugifev.pdf
    • https://karapinarinsaat.net/userfiles/upload/file/gukuwe.pdf
    • https://gccpay.net/wp-content/plugins/super-forms/uploads/php/files/b4c88e6dce82437279503d5c493a43bb/16452224001.pdf
    • https://haps.company/wp-content/plugins/super-forms/uploads/php/files/sf78rnsom13nqricipc2a0gqi2/10099281889.pdf
    • https://space1500.com/wp-content/plugins/super-forms/uploads/php/files/1f7c498d745f004fd004363d7aac21c8/muzenapozuro.pdf
    • http://albatrossmrn.com/konadnew/userfiles/file/32512227993.pdf
    • https://svetpoznaniyaonline.ru/wp-content/plugins/super-forms/uploads/php/files/ea023483532dcfe0dc85e2399a539740/24090420700.pdf
    • http://ahxxzx.com/userfiles/202105/file/duxadolisotepemutif.pdf
    • http://fantasypartyentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/160905a94124ab---48782192225.pdf
    • http://africanhairbraidingsalon.com/userfiles/file/65938509640.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=updated+ias-+usa+antiretroviral+therapy+guidelines+2018
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1d5.bin
30d0d6c38b1406e78370dfec93d54f7a15af6ee2468bba35427783ba25977c4b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD1D5 5924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.