Malicious PDF — malware analysis report

Static analysis result for SHA-256 4fd620aacc905e15…

MALICIOUS

PDF

178.0 KB Created: 2021-06-25 23:03:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-23
MD5: cf67d23fbb149e8636fda255a1fcabac SHA-1: b8c21d3a57db4115ccfae304b40bce2c4ae00d2b SHA-256: 4fd620aacc905e15618e35d18b622bcfa44518390502c617de3cc1358937b8d2
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected by ClamAV as a phishing trojan. Static analysis revealed it functions as a link farm, with numerous URLs pointing to compromised WordPress sites and potentially disposable hosting. These links likely serve as a lure to redirect users to malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3682

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.predoisiasociatii.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160a4b550ee9af---bixufovilufifulosoza.pdf In PDF document text
    • http://seamacros.com/upload/file/kenoxinudofepipimal.pdfIn PDF document text
    • http://ash-graphy.com/userfiles/file/51271035764.pdfIn PDF document text
    • https://thejinglelab.com/wp-content/plugins/super-forms/uploads/php/files/kdqv6q7o6jrf6u6sf7vcuuprg7/85096514739.pdfIn PDF document text
    • https://rmissio.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160c5f84c40d4c---10874561263.pdfIn PDF document text
    • http://www.playerclub.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160aae3513f297---60711626182.pdfIn PDF document text
    • http://bezpieczna-strefa.pl/wp-content/plugins/super-forms/uploads/php/files/70b70cd3644fcf43b31688ce1d98f250/13864264287.pdfIn PDF document text
    • https://www.adler-leitishofen.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607001ccab369---99529295088.pdfIn PDF document text
    • https://studio45.live/wp-content/plugins/super-forms/uploads/php/files/he9f8rv88s060onnt8hpojk20o/pozakiwisuruluxo.pdfIn PDF document text
    • http://www.loockuniformes.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/1608b9fbcd5327---56359238488.pdfIn PDF document text
    • https://www.hotel-palladium.gr/wp-content/plugins/super-forms/uploads/php/files/pjhmeu3heju0qeapei5v3mckhn/15659510454.pdfIn PDF document text
    • http://lotuscourtpune.com/wp-content/plugins/super-forms/uploads/php/files/g3gknqf47eu8gahio36ln3mbb0/36929591514.pdfIn PDF document text
    • https://revapackers.com/wp-content/plugins/super-forms/uploads/php/files/m4rj4epc5garpv677osboksqkh/99395052660.pdfIn PDF document text
    • http://sklepjola.pl/userfiles/file/5861159524.pdfIn PDF document text
    • http://goldenbaycruisesagent.com/userfiles/file/saduworisiber.pdfIn PDF document text
    • https://glosunspa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a46361a9c3---kolomobikot.pdfIn PDF document text
    • http://uyaviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083df7bc50cd---67043149318.pdfIn PDF document text
    • https://agsposure.org/wp-content/plugins/super-forms/uploads/php/files/1c5b257b3afd77ed252f8d7fbdf0eb04/nifosukozakoresowaze.pdfIn PDF document text
    • https://yarsan.ru/wp-content/plugins/super-forms/uploads/php/files/cd8f8dfc56d68a29e727c04b21cd5c36/saxibuverozomug.pdfIn PDF document text
    • http://firanywiktoria.pl/uploads/editor/file/82683367320.pdfIn PDF document text
    • https://martensmgt.com/business_school/uploads/file/webesinoxalep.pdfIn PDF document text
    • https://hotel-la-licorne.fr/userfiles/file/9991941309.pdfIn PDF document text
    • https://viajespereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b9893f13400---29744255499.pdfIn PDF document text
    • http://brighterhealthcare.co.uk/wp-content/plugins/super-forms/uploads/php/files/trs5sghrea45hb6k7b55vqt3nt/vitimiwadabujisuxime.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=order+wise+planets+namePDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00024e23.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24E23 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0002663a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2663A 10544 bytes
SHA-256: 70da8d5cc1dce6f914d56f70c2664e259117f7cc42c83673a93aefc3670271fd
font_02_sfnt_off00027e4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27E4C 21672 bytes
SHA-256: d39ce17368a65e780ac10f6a3256df20d88e2bdea32811344728337ae4488099

Open this report in the interactive analyzer, or submit your own file for analysis.