Malicious PDF — malware analysis report

Static analysis result for SHA-256 a048ab680a13d602…

MALICIOUS

PDF

177.7 KB Created: 2021-06-20 09:37:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-01
MD5: 9cc06cf17f5af0f0c0e2e95e3427672d SHA-1: 648a202a1f7a693d4fa7d3cd11651504e9ea4ebb SHA-256: a048ab680a13d602575dc3a97963acbec75505b67cbe076601f0f5a86e50dbbf
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV. The file embeds a large number of external links characteristic of an SEO link farm, many hosted on compromised CMS upload directories. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier clean score 0.0835

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://a-range.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160a1412bd03cf---70929217816.pdf In PDF document text
    • https://daaeportrett.no/upload/file/31382314906.pdfIn PDF document text
    • https://xn--80aaa1anac6cg.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/e93344e6bb7a58265842f527bbf140e8/sujitoliw.pdfIn PDF document text
    • https://canadiancontractorservices.com/wp-content/plugins/super-forms/uploads/php/files/ilfa272d3ii11ldi4vn2o9g0k2/74110324970.pdfIn PDF document text
    • http://clubmaniacr.com/campannas/file/zumozad.pdfIn PDF document text
    • http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/v46fegv9iklfc2djicg3n56bf6/76310703026.pdfIn PDF document text
    • https://soba05.org/wp-content/plugins/super-forms/uploads/php/files/5b980c2e8887b8378c8da12b358864c1/91543117205.pdfIn PDF document text
    • http://iwish-cosmetics.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609fd9711d153---3909615391.pdfIn PDF document text
    • https://medok18.ru/wp-content/plugins/super-forms/uploads/php/files/b5241a6dd7c87152e5be87ad335ebfd6/29144938331.pdfIn PDF document text
    • https://n95america.com/wp-content/plugins/super-forms/uploads/php/files/0feb797d2a247a7b9d42b79f8bad65b4/wefuge.pdfIn PDF document text
    • http://www.communityheroesproject.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607f1ad487c4f---16189683150.pdfIn PDF document text
    • https://aquariumfargo.com/wp-content/plugins/super-forms/uploads/php/files/12af8da01a709431eaddd183e43f882c/pelupubegalofipiro.pdfIn PDF document text
    • http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c3069860025---28835444645.pdfIn PDF document text
    • https://ifacemount.com/wp-content/plugins/super-forms/uploads/php/files/k35us490fne5t6n8qen7a9rkbd/77025414461.pdfIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
    • http://smc.org.inhttp://smc.org.inIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=june+july+august+september+calendarPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text
    • http://www.gnu.org/licenses/lgpl.htmlRegularDanhHongIn PDF document text
    • http://www.geocities.com/dnhhngIn PDF document text
    • http://sinhala.sourceforge.net/In PDF document text
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITSIn PDF document text
    • http://www.gnu.org/licenses/gpl-2.0.htmlIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_012_off00027c4e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x27C4E 27688 bytes
SHA-256: 017fcfadb5ea60c9f141ba1d7330c418b76734e77d13458964134fd46635be9b
stream_013_off0002b27f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2B27F 7602 bytes
SHA-256: 690600be78294c2f62f9f3a2b115952a82613ca37cb23b62b9fdb7a5aa7bd965
font_00_sfnt_off000143d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x143D8 5700 bytes
SHA-256: 391ead5556db545a670a1b739d098d2783da3445e3d9d8f591bed80c895f006a
font_01_sfnt_off0001572b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1572B 6944 bytes
SHA-256: 30a7e6ef0a77a3976a054ed3b31e5437a59d693fdb6fea8eae0d073e4b435932
font_02_sfnt_off00016c0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16C0B 10340 bytes
SHA-256: 77ff93f0fa2a3500d3145786bbd5d4d6ab9f54f7950dc53ba10d8cc4d89bfc91
font_03_sfnt_off00018d5b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18D5B 6780 bytes
SHA-256: 10002fc2944cfa692409c23d2250dc187eaf328fbc76c9084913cac702060bb0
font_04_sfnt_off0001a580.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A580 16460 bytes
SHA-256: 53214900568711b3ca514c4c8663df98e36fe957a2803411c167671e3ef14266
font_05_sfnt_off0001ca4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CA4C 11256 bytes
SHA-256: 5a543025ac5916ff76863715225857aa7fea20e6e46005abe2251343661ee9e0
font_06_sfnt_off0001ea7a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1EA7A 5672 bytes
SHA-256: 44b5c451207da7dd533b2968c429aee9b6ce1d1b9a8b036da186250689a90203
font_07_sfnt_off0001feed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1FEED 15668 bytes
SHA-256: 3a2b5bce984be28c00bdd01892abe6c9ec70685e9e5238901c1c3b140e7ceec2
font_08_sfnt_off00022887.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22887 10320 bytes
SHA-256: 074032e6a1897458a5f7f4984b892c8b6afbe28af1de3fb2f1a3ce429ab79c78
font_09_sfnt_off00024584.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24584 19548 bytes
SHA-256: e411ef652642b6b8ac3bdcbe706403fd5f8740e8aca435be93b68eead95d31c9

Open this report in the interactive analyzer, or submit your own file for analysis.