Malicious PDF — malware analysis report

Static analysis result for SHA-256 b04e57bffbc33a7b…

MALICIOUS

PDF

254.1 KB Created: 2021-08-04 22:15:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: b52f46318cf777a0fdfbe6c36836fc47 SHA-1: 2dadfd6edea507694a2fc833dd8e222ee9e1eebd SHA-256: b04e57bffbc33a7bc121b0f6783c93fb589ee4e8893b37540f3e1deee357c76d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected by ClamAV as Pdf.Phishing.Trojan. It contains a link farm with multiple URLs pointing to compromised WordPress sites, specifically within the uploads directory of super-forms plugins. One such URL is http://alsumiri.net/wp-content/plugins/super-forms/uploads/php/files/335ffbe409d3e87ce38b2bd69c44f568/tofomuz.pdf, which is likely a lure for users to download further malicious content. The presence of numerous links to compromised CMS uploads suggests a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier clean score 0.1554

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lungshingcentre.com/userfiles/59638910909.pdf In PDF document text
    • http://bamt.be/wp-content/plugins/formcraft/file-upload/server/content/files/1606d2309a73a3---fuxibuwejunaper.pdfIn PDF document text
    • http://kgmda.com/upload/files/jigosupev.pdfIn PDF document text
    • http://kashima.cc/userfiles/file/3592979149.pdfIn PDF document text
    • https://nepalimodelagency.com/userfiles/file/manopirime.pdfIn PDF document text
    • https://forumhotel.by/wp-content/plugins/super-forms/uploads/php/files/87pqk1f0toud1no57aahor2pt6/buxefisitajufivudi.pdfIn PDF document text
    • http://alsumiri.net/wp-content/plugins/super-forms/uploads/php/files/335ffbe409d3e87ce38b2bd69c44f568/tofomuz.pdfIn PDF document text
    • https://vate-tire.ru/wp-content/plugins/super-forms/uploads/php/files/bb975999388d280e5f8f3a55025fff83/4112084846.pdfIn PDF document text
    • https://neoville.ru/wp-content/plugins/super-forms/uploads/php/files/6b803d9543103eba3308c4ac8f887af0/95712272749.pdfIn PDF document text
    • http://luckyassessoria.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160f7e56c7fec5---namalima.pdfIn PDF document text
    • http://gallery4walls.com/upload/editer/file/vawajezaxarepakelisaziti.pdfIn PDF document text
    • http://agendatourvietnam.com/hinhanh/file/88086312141.pdfIn PDF document text
    • http://evabody.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607cb9171eec6---77055547222.pdfIn PDF document text
    • https://kayakbranson.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078d730327d5---43311823537.pdfIn PDF document text
    • http://habitat3.eu/userfiles/files/doxoxikemibojod.pdfIn PDF document text
    • https://twfern.org/upload/ckfinder_temp/files/20210619083034.pdfIn PDF document text
    • https://cbolean.com/wp-content/plugins/super-forms/uploads/php/files/26pp7qkqeitq0r0roscrd8l8r5/tinefiravudenudigaw.pdfIn PDF document text
    • http://anhopphat.com/uploads/files/metofilewek.pdfIn PDF document text
    • http://uppercanadatwocylinderclub.com/clients/877835/File/15647649437.pdfIn PDF document text
    • http://www.platformliften.info/wp-content/plugins/formcraft/file-upload/server/content/files/160a141c4df21d---96778785303.pdfIn PDF document text
    • http://colegiosantarosa.com/uploads/imagem/file/61215020600.pdfIn PDF document text
    • http://vantaibactrungnam.vn/upload/files/pomevovuxususiludolemeli.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=kickin+it+episode+21+season+1PDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000393c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x393C5 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0003abdc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3ABDC 10616 bytes
SHA-256: 14d9934561f23c52b7ddf0624e0cadd64ff6cf827bdd95914d755458716ffa56
font_02_sfnt_off0003c45e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3C45E 17612 bytes
SHA-256: 6d52d1a217a3629c094362a5aa0315c541ce437d7148c9158119c44f04f04cf2

Open this report in the interactive analyzer, or submit your own file for analysis.