Malicious PDF — malware analysis report

Static analysis result for SHA-256 8dfc577e12933230…

MALICIOUS

PDF

64.8 KB Created: 2021-04-29 21:52:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: f8c48bcfff4fe8c704654ebbfdf3fa4b SHA-1: cb97cfa0fa1e1890fea33736077fd1986ce9c192 SHA-256: 8dfc577e129332307bd5a5e8e9252b78289ef1f7030ca4a01a7832c74b296f18
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a link farm pointing to compromised WordPress upload storage, suggesting it's used to host or distribute malicious content. The document body, though heavily obfuscated, appears to be a lure related to a calculator, likely to trick users into visiting the linked sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8355

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amako-ra.com/wp-content/plugins/super-forms/uploads/php/files/6fb54f38c73612e3dedb42fbfda0d462/sujezobezanawowurot.pdf In PDF document text
    • https://unitedcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607627fcf2846---37250108965.pdfIn PDF document text
    • http://www.mtpartnersfl.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607abec744c4a---vuwemena.pdfIn PDF document text
    • http://audiomaster.se/wp-content/plugins/formcraft/file-upload/server/content/files/16075ea8ba7838---75658152817.pdfIn PDF document text
    • http://www.ddd-iasi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1606ee58a922c5---9625025299.pdfIn PDF document text
    • http://amtusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e8e4c1d60e---jajudafisolot.pdfIn PDF document text
    • http://math-talk.kr/wp-content/plugins/super-forms/uploads/php/files/33eggivdiqjv2p0o6lelrs92sk/71134247904.pdfIn PDF document text
    • https://realimpacto.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1606c914ec3c17---95900136010.pdfIn PDF document text
    • https://nhaban24h.com.vn/wp-content/plugins/super-forms/uploads/php/files/8t7s1032hgci3l7v1rjuee3gph/40927272657.pdfIn PDF document text
    • https://eyestech.in/wp-content/plugins/super-forms/uploads/php/files/ilc297a9g51gtfbn91kk5aqb7f/20566977070.pdfIn PDF document text
    • https://www.hamburgeriaagricola.com/wp-content/plugins/super-forms/uploads/php/files/19ccoc0tg1o94hg23e6bc478pt/nutukumofer.pdfIn PDF document text
    • https://binhruamuinanobac.com/wp-content/plugins/super-forms/uploads/php/files/u4u6ogo27hspacdkjq1bmkr2cf/bibilajerabutogarowalirel.pdfIn PDF document text
    • https://precisionautoandac.com/wp-content/plugins/super-forms/uploads/php/files/d02028366f1e88160993ce696c325872/56836533825.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3CAf4wW3hvY/uplcv?utm_term=reduced+row+echelon+form+calculator+with+decimalsPDF link annotation
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d180.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD180 5360 bytes
SHA-256: e1d4e711a7b9e93271c8331b30f10f542f2605d415814f0d702ac77aae9b6265
font_01_sfnt_off0000e3a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3A9 10680 bytes
SHA-256: b008ee17f84e180b0860e284e7e253abda091776136758de464c8f85ddcb963e

Open this report in the interactive analyzer, or submit your own file for analysis.