Malicious PDF — malware analysis report

Static analysis result for SHA-256 746dcc1cb34ad354…

MALICIOUS

PDF

84.6 KB Created: 2021-07-20 22:42:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: ed1276afd8840b5f371daed8967316bd SHA-1: 0caef9beacd726056b56af5195ad6f0a45aca50e SHA-256: 746dcc1cb34ad354c9edb3092d8f0acf1d5ddff3fb4a8fa7b6cf7275034959ce
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains embedded JavaScript, which is often used to initiate malicious actions. The heuristics indicate that the PDF acts as a link farm, directing users to compromised WordPress upload storage, likely to download further malware. The ClamAV detection as 'Pdf.Phishing.Trojan' strongly supports a malicious intent, likely a phishing lure disguised as a game trainer.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3776

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://alvasari.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083efe7b83ae---bagetevujolomemoloneju.pdf In PDF document text
    • http://aiswaryamatrimonials.com/fck_uploads/file/76527469246.pdfIn PDF document text
    • http://lexus-custom.com/js/upload/files/58755875087.pdfIn PDF document text
    • http://heorungminhphat.com/luutru/files/26101939178.pdfIn PDF document text
    • http://www.onekaddy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160869d0fc8b14---mufuva.pdfIn PDF document text
    • https://traveltokiev.com/wp-content/plugins/super-forms/uploads/php/files/6pvgupt7gs4jmnoaor1ecveqg5/95577489722.pdfIn PDF document text
    • https://ag-concept.ru/wp-content/plugins/super-forms/uploads/php/files/c27cc89899a4e55751a47802d4e96f4f/82976001079.pdfIn PDF document text
    • http://gidaero.com/upload/fckeditor/file/20104851520.pdfIn PDF document text
    • https://urbanplace.me/wp-content/plugins/super-forms/uploads/php/files/64d7a384055d78243af8ee39a8b27968/20992423434.pdfIn PDF document text
    • http://ecbpolska.pl/wp-content/plugins/super-forms/uploads/php/files/f5d9d319e310b4d7ceae955ee64d2e1d/55129285269.pdfIn PDF document text
    • http://www.itbaloch.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b00565c7344---lugaral.pdfIn PDF document text
    • https://qualitylightsolutions.com/wp-content/plugins/super-forms/uploads/php/files/e8e0add344ed0e8d072ad4572568f5f2/61768791745.pdfIn PDF document text
    • http://doo-san.com/userfiles/file/20210613230504.pdfIn PDF document text
    • https://www.hospedeagora.com.br/wp-content/plugins/super-forms/uploads/php/files/kmq10hvk9vbbsadf573m8o3clj/vajiferesemadusalesuka.pdfIn PDF document text
    • https://rffsev.ru/wp-content/plugins/super-forms/uploads/php/files/d2bab6e6170f549aafb73d222a709091/94730177092.pdfIn PDF document text
    • https://lapakunited.com/contents//files/noduweputivobaweso.pdfIn PDF document text
    • http://www.chicagoalphas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072054c98e7e---44002411427.pdfIn PDF document text
    • http://dothi.info/images/files/49349030011.pdfIn PDF document text
    • https://pensionatiitalianiinportogallo.it/wp-content/plugins/super-forms/uploads/php/files/8cd97a34bc2459266db68e3e620f5cde/31991270042.pdfIn PDF document text
    • http://europeanprofservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084702db8dba---saxoget.pdfIn PDF document text
    • https://diarch.in/WYSIWYGImage/file/nefudu.pdfIn PDF document text
    • http://galluccifaibano.com/userfiles/file/danurowikugewixarituwimeb.pdfIn PDF document text
    • http://loaamtran.vn/files/usersfiles/files/60303725979.pdfIn PDF document text
    • https://carpanea.it/wp-content/plugins/super-forms/uploads/php/files/66f5847660bd1fc54ad7d0e2cb8b99c9/guranowewuneraku.pdfIn PDF document text
    • https://wentworthre.com/wp-content/plugins/super-forms/uploads/php/files/125fc7555a7540a9f6ee1a675cc585df/gosiragesuzokafi.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=assassin+creed+3+trainer+all+versionPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f673.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF673 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00010e85.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E85 18340 bytes
SHA-256: 98dbcc07812c8d9aac37e01d9298aff4101ee9f525d312f9d4f8f8204238a128

Open this report in the interactive analyzer, or submit your own file for analysis.