Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c4892122d8af615…

MALICIOUS

PDF

78.2 KB Created: 2021-06-20 13:42:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: dc2773647f60c09a733f571c174ee125 SHA-1: c94a1a904c3295fbc57df0bbbae11d2a76146285 SHA-256: 4c4892122d8af61564a931ab3c2b3c09def64b9eac3e80ad36ba572b674296bd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF contains a link farm pointing to compromised WordPress sites, likely intended to trick users into downloading further malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded URLs suggest a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.misshandicap.ch/wp-content/plugins/formcraft/file-upload/server/content/files/160a29d6554fbd---zanowafezigepan.pdf In PDF document text
    • https://amerismithenterprises.com/wp-content/plugins/super-forms/uploads/php/files/f666b1a75705ec7d93b05091f129cf30/zemubuwufajimexekup.pdfIn PDF document text
    • http://www.jesuseslaroca.org/wp-content/plugins/formcraft/file-upload/server/content/files/16095acc0b041b---xumujenunoxinumesuweri.pdfIn PDF document text
    • https://beaumont-residence.com/wp-content/plugins/super-forms/uploads/php/files/2nh54rtmhbnevlescsgdirebr9/32286838454.pdfIn PDF document text
    • http://palyavalaszto.hu/teszt/upload/file/kufepelereva.pdfIn PDF document text
    • https://argentinaproduct.com/ckfinder/userfiles/files/97249601589.pdfIn PDF document text
    • http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/160739d057f356---gipulu.pdfIn PDF document text
    • http://centralcogtc.com/uploads/file/60925057539.pdfIn PDF document text
    • http://www.tecnotrefg.it/wp-content/plugins/formcraft/file-upload/server/content/files/1608fe54635d3a---tusozaxikejipijofesawoza.pdfIn PDF document text
    • http://xn--80ackbssfuieecff0e8c.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/k2lpg86easfcv659gf7c9doss1/18241668492.pdfIn PDF document text
    • http://nail-free.com/ckfinder/userfiles/files/98926265477.pdfIn PDF document text
    • http://www.neslihanonur.com/wp-content/plugins/super-forms/uploads/php/files/90593e8098195fe8559804842182d058/pebalerijazupulezes.pdfIn PDF document text
    • https://www.baileysmilk.com/wp-content/plugins/super-forms/uploads/php/files/58e17f6b2b0c47fdf0e510a8838e45d6/74489294069.pdfIn PDF document text
    • http://rolmech-strzelno.pl/Upload/file/78198908431.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160941f4e11d4a---fewopaw.pdfIn PDF document text
    • https://ifacemount.com/wp-content/plugins/super-forms/uploads/php/files/ddkd92gaog7c35irn08kisv282/kokilemanikegurusavaz.pdfIn PDF document text
    • https://a2designbg.com/userfiles/file/91919477049.pdfIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/zMnd8XtcwSM/uplcv?utm_term=roblox+periastron+gear+codesPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD3E1 6440 bytes
SHA-256: 2ce5a7286efefc5aae27ce1c31b3347e159d00bd30cf97f509a0b7f7d49caffb
font_01_sfnt_off0000e3c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3C6 1632 bytes
SHA-256: 58a2919dcfaa934042195e5a2178fd0e6fb4949cca5b032ed49cb592754c3303
font_02_sfnt_off0000ebf7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBF7 5456 bytes
SHA-256: 4ab372abe866d18d4c818f5aebe15194b1327c43be7b920cac464f7a6f199139
font_03_sfnt_off0000fe92.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE92 12980 bytes
SHA-256: 16ca9b40177a67b67875d67acf1cd6f1eed7059462b43e785030e52440bf04dd

Open this report in the interactive analyzer, or submit your own file for analysis.