Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c722653a9e735b9…

MALICIOUS

PDF

74.0 KB Created: 2021-05-27 13:18:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 61f5e8985e5f7acc26b175f2622bd103 SHA-1: a05bfd35a25115a6dc272b872ea75f23769754ce SHA-256: 8c722653a9e735b915438fa039df746ed93f6851f2193b1ccd1dffb98fc2eece
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm pointing to numerous compromised WordPress sites, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were directly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to lure users to external, potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9845

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.actionconstructionjax.com/wp-content/plugins/super-forms/uploads/php/files/24a0f404ad37123419ac26d5a2bd4ac4/79657216516.pdf
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/oiafho0gveru2k3rircc1hgp6n/relarudojo.pdf
    • http://www.vivelamusica.es/wp-content/plugins/formcraft/file-upload/server/content/files/1608ea4c50f0ab---93141925145.pdf
    • https://wkd-uk.com/wp-content/plugins/super-forms/uploads/php/files/b23d4b40d88826b4b80e3156d86a6e66/66790612555.pdf
    • http://thefutureofgolf.eu/wp-content/plugins/formcraft/file-upload/server/content/files/1609354185b656---foludozufomugifejuja.pdf
    • http://www.alwaysflorida.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073b71233c9d---8340376251.pdf
    • http://mp-hd.de/data/aktualnosci_imgs/file/16696417277.pdf
    • http://bizwd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160799f53deb79---bopujovovuxob.pdf
    • https://dacinsara.ro/fckfiles/file/pegewikilog.pdf
    • https://hps-gruppe.com/wp-content/plugins/super-forms/uploads/php/files/7mmkvknuai7ne1el4gu9e243at/fanixesovijujerox.pdf
    • http://vasilii-orlov.fun/wp-content/plugins/super-forms/uploads/php/files/a8e43e402df4a4163fec03a2e7ccd112/nobagevovenenularivamogaf.pdf
    • https://plumcourse.com/wp-content/plugins/super-forms/uploads/php/files/028e90bddecf9c5ada125d27866f9478/46403346781.pdf
    • https://desertflying.club/wp-content/plugins/formcraft/file-upload/server/content/files/16080610234868---91270082776.pdf
    • http://www.thediethub.in/wp-content/plugins/formcraft/file-upload/server/content/files/16081b7aa04d2d---visavupawiwe.pdf
    • https://www.ediliziaindustriale.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a00a9223763---lolirisedawitulotutadu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=chapel+of+the+flowers+las+vegas+nv+89104
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed2b.bin
9e75dc9d77ab5de4e266088d34352b7a518823464b7733ba13f136538f784ac6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED2B 5852 bytes
font_01_sfnt_off00010130.bin
92871f60d7214fd1c16fc9deafc358571e0b89826b4d07c74ade18c10a550f0a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10130 15404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.