Malicious PDF — malware analysis report

Static analysis result for SHA-256 703b97c5f8e1c702…

MALICIOUS

PDF

82.2 KB Created: 2021-05-25 15:50:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7320c12257c6aba1c11698b1ede858f1 SHA-1: 1798f73e0f259d5a88689655b4e8c4e8c154d054 SHA-256: 703b97c5f8e1c70263741bc092ae29ec53ea0862832d9bef776b8f48b3412a6b
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm pointing to compromised WordPress upload directories, suggesting a phishing or malware distribution lure. The presence of 'adobe illustrator cc 2017 crack amtlib.dll file' in the document body strongly indicates a lure for cracked software. ClamAV detection as Pdf.Phishing.Trojan further supports the malicious classification. No scripts were extracted, but the overall structure and content point to a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9514

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mandalaconfeccao.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607acb3964d78---lizovediwumurif.pdf
    • http://vasvaripalmuzeum.hu/upload/file/57874024466.pdf
    • http://dangkyidol.com/wp-content/plugins/super-forms/uploads/php/files/17t9nspv0vacug8qnubrk84pkc/17659618041.pdf
    • https://www.tctnanotech.com/wp-content/plugins/super-forms/uploads/php/files/4b580d3bb9a016cbcea30aa9fc927351/90150662958.pdf
    • https://www.gs-gleichmann.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a490b49a181---43994601353.pdf
    • http://averon.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609d9fa42f46d---fosuniwokegogiso.pdf
    • https://www.ediliziaindustriale.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077f07080152---28844733443.pdf
    • https://www.espymetcalf.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a75296141a4---fovumivetedap.pdf
    • https://www.pal-kont.hu/wp-content/plugins/super-forms/uploads/php/files/4ba541a7a3736c81d86432c396ddfdb6/61320977163.pdf
    • https://www.aironface.com/wp-content/plugins/super-forms/uploads/php/files/f36f244d6535c24037b3f53f6b1296c6/zipefimeritivisalazu.pdf
    • https://soechi.net/userfiles/file/notuzefa.pdf
    • http://for-rent-aalst.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d34be20fe4---kokeboxiwozudulufaf.pdf
    • https://yidinfo.net/wp-content/plugins/super-forms/uploads/php/files/sivu90hb3clbcb47gjuetu123u/26581013662.pdf
    • http://in-dapt.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084d37e58eb2---63854343560.pdf
    • https://mziagroup.com/wp-content/plugins/super-forms/uploads/php/files/s32p5s6bmlf137d1p6lgkdolli/sajimarikubetezafije.pdf
    • https://primeodontorj.com/wp-content/plugins/super-forms/uploads/php/files/3e320fa2ed9a63a17202cf6fbbd72031/rupexetabodemari.pdf
    • https://interesttour.com/wp-content/plugins/super-forms/uploads/php/files/880634ada99ac7c82b58d1a7d28bf6af/37411311845.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/BkSY9tpko7c/uplcv?utm_term=adobe+illustrator+cc+2017+crack+amtlib.dll+file
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e10e.bin
96c06faaaa84f93bfbf66814810e0493cb0e2cab1f211e74ebb3f8d2b32c1ee2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE10E 6164 bytes
font_01_sfnt_off0000f64c.bin
da3fce0f05e26b185f8062f1fbf5440da4114f2dc2ef02e2eb336e7484deb8d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF64C 5796 bytes
font_02_sfnt_off00010a05.bin
a3f2b9490005629485bd4267e919f0845e1b8c32cd98b05ac119a81c4e490013		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A05 13488 bytes
font_03_sfnt_off0001340c.bin
39475c799b5d56399bb34e207be858b8214e3beaa60953acc23ccdd8a6933236		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1340C 16456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.