Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2334d333e3d6d35…

MALICIOUS

PDF

62.7 KB Created: 2021-05-26 07:58:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 780c205e9d2afb39f71668b412a895b8 SHA-1: c7ee40ba29d3a4bb631d32e271ffff1011278c9c SHA-256: a2334d333e3d6d35bb55a4ddd6171819b1d78b51b68b825aa01d3eefe92bb051
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It functions as a link farm, directing users to compromised WordPress upload storage and other disposable hosting sites. The document body, though heavily obfuscated, appears to be a lure related to 'recetas de comida tradicional mexicana pdf', suggesting a phishing attempt disguised as a document download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8552

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/uplcv?utm_term=recetas+de+comida+tradicional+mexicana+pdf
    • http://getawaynewzealand.co.nz/wp-content/plugins/formcraft/file-upload/server/content/files/1607d37afd00b8---nukolus.pdf
    • http://victorylimo1.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072252ff2dbb---venoras.pdf
    • https://tenfci.org/userfiles/file/rojovolazamewusit.pdf
    • https://tocgia247.com/wp-content/plugins/super-forms/uploads/php/files/67da71cakst0tg84kugol8hhtn/xixusalobomekamuxulezu.pdf
    • https://amerismithenterprises.com/wp-content/plugins/super-forms/uploads/php/files/86fa85ac7a89ed24e9fb60eb94b6aaa0/suxewejuporezupozuxil.pdf
    • http://jockmurray.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a345f72b5ef---77380217268.pdf
    • https://glass-haus.ru/wp-content/plugins/super-forms/uploads/php/files/42640199ecd9ae5066bac754d3488b69/wozudoruseravod.pdf
    • https://ipcare.nl/wp-content/plugins/super-forms/uploads/php/files/ldbq1klk9e2prr51s6o9f77mhh/vuxudoxuzigatevijigojaf.pdf
    • https://www.revistadefiesta.com/wp-content/plugins/formcraft/file-upload/server/content/files/160984b7691723---vamox.pdf
    • http://warraichmeats.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607496fb25e97---66256536514.pdf
    • https://homini.eu/wp-content/plugins/formcraft/file-upload/server/content/files/1609edb2e6d8e5---pafub.pdf
    • https://tcufroghouses.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077636b95440---41616876168.pdf
    • https://alfa-clining.ru/wp-content/plugins/super-forms/uploads/php/files/d7d1a1396812e96196ffe4679e84665e/2218073265.pdf
    • http://www.marcelasemper.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609767356371c---41520469411.pdf
    • http://www.rkcomdesignservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098f284184c4---likaxaremevurube.pdf
    • https://rebel-guitars.com/wp-content/plugins/super-forms/uploads/php/files/7310513dc28c17d391b3e2d6047451a1/41434566602.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d83e.bin
a1b67cbdc91bb9566d9157e155b2c81e8df782bf993104348318ed45f118593e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD83E 5376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.