Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfd153367bc31752…

MALICIOUS

PDF

73.3 KB Created: 2021-05-04 00:50:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6fae4e014765e744be292d37be9f16f3 SHA-1: dd49f843f1ba8f8407171131eac668cd978845b7 SHA-256: bfd153367bc31752bd1a78d5e250d4675e500bebf17739b89ace2983852587e8
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. Analysis reveals it functions as a link farm, with numerous embedded URLs pointing to compromised WordPress sites. These links likely lead to further malicious content or phishing pages, aiming to deceive users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9723

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://andreagarciam.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606fbae2db6e0---28364303998.pdf
    • https://hylyt.co/wp-content/plugins/super-forms/uploads/php/files/fac1e0a983661dbc961e7da845568419/mutij.pdf
    • http://www.ponderosafestival.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ebce43151f---8608680429.pdf
    • http://ar-intl.net/wp-content/plugins/super-forms/uploads/php/files/geq9hgqethf444tnpbv8tem5v6/75784109420.pdf
    • https://camile.vn/wp-content/plugins/super-forms/uploads/php/files/8pt9j3f5onkjp99ldaf16kuuej/67934114261.pdf
    • http://africa-emergence2019.com/userfiles/file/98776421598.pdf
    • https://akarchlight.com/wp-content/plugins/super-forms/uploads/php/files/85a0b6385f79233bc348fb7d51f87111/korijisoz.pdf
    • http://www.leesii.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cfe23ee45e---bemuf.pdf
    • http://www.norestim.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1608674cae6773---72608557162.pdf
    • https://www.movingwithmagna.com/wp-content/plugins/super-forms/uploads/php/files/df3e53e9f30a0e5aafc9b6bd100283f5/lirevawobegudafe.pdf
    • http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607916cdb23a0---13724418568.pdf
    • http://abpaluso.com/upload/file/96115259346.pdf
    • http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/aie62tbuocgg3b0i4kccou72j3/xitamatovujixagujofirop.pdf
    • http://www.timtransportes.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/1606e7e5f07372---50949569148.pdf
    • https://ludifrance.fr/userfiles/file/sivovuxijazujog.pdf
    • http://xn--90ad5ackt1d.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/6f672533463449dc24fa771f90cdb7ac/tufefu.pdf
    • http://lapenya.cat/imgjovesnaves/file/4611880201.pdf
    • https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606c77fbc1c38---46681089142.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/1KS0DP0cxss/uplcv?utm_term=crossfire+ph+manual+patch+forum
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db7e.bin
7e4b914aa430f05dc2ab9ba280b98f0aa04cf24bd481a6b1c297ca1312da7fd6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB7E 5160 bytes
font_01_sfnt_off0000ecd5.bin
8ab923703a6cb8420f8fca7bd3ad5728ba4bd58dd88d5cf9a7680080d3c28edf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECD5 1908 bytes
font_02_sfnt_off0000f625.bin
6e3d83997ea455e7e21fa36aea3c17db0852bf73625878e9ef7955c168eb7cc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF625 10772 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.