Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7c6fc2c7dd550ef…

MALICIOUS

PDF

64.0 KB Created: 2021-05-18 13:55:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 261be0b554b942a543e0ada0ef013359 SHA-1: 81b677497e533e02ece49ccc39626451dd48e051 SHA-256: c7c6fc2c7dd550ef879cfc85f5792f46c3e2d839109194d507bc52d73c24d74a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document is classified as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. It functions as a link farm, directing users to download software, specifically a cracked version of AutoCAD, from various compromised WordPress sites. The presence of multiple external URIs and link farm heuristics strongly suggests a social engineering attempt to trick users into downloading malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8681

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=descargar+civilcad+para+autocad+2014+64+bits+gratis+con+crack
    • http://absolutelyneon.com/userfiles/file/putegelasuvesubabamezupim.pdf
    • https://www.beewellrx.com/wp-content/plugins/super-forms/uploads/php/files/tmp/rumanodoxemolufuzakib.pdf
    • https://fellowpeo.com/wp-content/plugins/super-forms/uploads/php/files/743a26929ff1d85f5acd18df1b5cf2fa/tagakazajunuxewaruf.pdf
    • http://www.adatechotomasyon.net/wp-content/plugins/formcraft/file-upload/server/content/files/1606ce82ac52f2---99699400364.pdf
    • http://pphu-joanna.pl/fckpliki/file/48433712538.pdf
    • https://www.medipratik.com/wp-content/plugins/formcraft/file-upload/server/content/files/160749712c52d5---rokiwenepujodi.pdf
    • http://www.akutrans.com/wp-content/plugins/formcraft/file-upload/server/content/files/160818b8fd2379---zoreru.pdf
    • https://lightspec.ca/wp-content/plugins/super-forms/uploads/php/files/74e2493144f7b7d43da89396063311e4/pekukejasavefavokafivewo.pdf
    • http://www.petersmetalstitching.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16079ac2863ac8---lifaluba.pdf
    • https://yourtuscanyguide.com/wp-content/plugins/super-forms/uploads/php/files/q79mhnjj04lit6k8doj5e19gj2/butatanejixudab.pdf
    • http://aite-materials.com/upfiles/file/2990494186.pdf
    • http://talleresjpg.es/img/file/7220016997.pdf
    • https://stegopackaging.com/wp-content/plugins/super-forms/uploads/php/files/mljfc4j2bkkab4qa6nh4to399j/mebeberodepuro.pdf
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090e64282316---zulozupudavelivadifi.pdf
    • http://www.nandomoraes.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1608590365b57b---46813971340.pdf
    • http://www.alwaysflorida.com/wp-content/plugins/formcraft/file-upload/server/content/files/160834f8265ec2---babobumimakafa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3dc.bin
4e10b1ecc73b68d6e9de2da8560f4604d27bd1b700c3d591df28237ad7237b38		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD3DC 5952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.