Malicious PDF — malware analysis report

Static analysis result for SHA-256 9783d281a943b02d…

MALICIOUS

PDF

66.4 KB Created: 2021-05-19 12:57:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9ff231a3956c3bd52895c0f5edb3ad7a SHA-1: e4ab8be153ab37110d982db04fc5eaff383e585e SHA-256: 9783d281a943b02d6ddf592ffd20bb0c877b02d2bd7ecdc1c3749d73c3020982
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm pointing to multiple compromised WordPress sites, a common tactic for distributing malicious content. ClamAV and ML classifiers flagged this PDF as malicious, specifically identifying it as a phishing trojan. While no scripts were directly extracted, the structure and URL patterns strongly suggest an intent to redirect the user to a malicious payload or phishing page.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8612

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.cr-sdc.org/wp-content/plugins/super-forms/uploads/php/files/ac764f1036bb1b05ff8498e7fe4d77bd/doxekaporajeguguwenixufi.pdf
    • https://polskieplytki.com/wp-content/plugins/super-forms/uploads/php/files/35176fdaea3a7c426f4fc5567f3970c1/jilegigupabubolurisinura.pdf
    • http://hillcountryawningsandsunscreens.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e3bc55572f---27642759081.pdf
    • https://www.medicalart.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1607adfa77c79b---17926669511.pdf
    • http://ophirtonhotel.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16071cbf65602f---nowoxa.pdf
    • https://weinquartier.at/wp-content/plugins/super-forms/uploads/php/files/6d66da340fb2178d8a512ba72958f5c8/kopezejomeritujesisow.pdf
    • http://georgekoldun.com/var/upload/file/23328578621.pdf
    • https://aprilboya.com/userfiles/file/87245457417.pdf
    • http://www.marcado.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16077de9226309---57657343696.pdf
    • https://ailani.org/wp-content/plugins/super-forms/uploads/php/files/1a1b7ead5cbf8c2be6587780cd10381d/5716295747.pdf
    • http://ahdongjiu.com/upload_fck/file/2021-5-19/20210519010739143497.pdf
    • https://www.dolphinrfid.com/wp-content/plugins/formcraft/file-upload/server/content/files/16091194840bc2---84553061093.pdf
    • https://prikolnaya.com/wp-content/plugins/super-forms/uploads/php/files/e1e30210a686909ab5a590567cef9a0b/28046784759.pdf
    • http://victorylimo1.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080f8400e8c7---48423928310.pdf
    • https://wilsonbarrera.com/inicio/wp-content/plugins/formcraft/file-upload/server/content/files/1608544e02ae12---meliditetij.pdf
    • http://leap-egypt.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e25bd801e1---54567470916.pdf
    • https://yidinfo.net/wp-content/plugins/super-forms/uploads/php/files/6h220lprmdhf5bp51knog897it/19672459087.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/skout/mBVl/~3/S30rS-6n6vg/uplcv?utm_term=nadra+b+form+tracking+pakistan
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d82c.bin
b57231c5de764a611069e49ef960921b1199cecaef65289fd4e77ad63e392ee7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD82C 5616 bytes
font_01_sfnt_off0000eb39.bin
54309e7bbdda170ca3cc4432daa96b715413ef30f8579dd3edbaa80aada87352		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB39 9812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.