Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca0a0d88a05848d6…

MALICIOUS

PDF

236.2 KB Created: 2021-07-19 06:14:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-29
MD5: 93d02221bb44e5172e80379a0c55305e SHA-1: 701aecfffa58762861149119192ede6d61ac5e0c SHA-256: ca0a0d88a05848d60248f91827230c5cda36f9e57bbe28595d1de21013b122d8
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was detected as a phishing trojan by ClamAV and flagged by an ML classifier. It contains embedded JavaScript and a link farm pointing to compromised WordPress upload directories, suggesting it's designed to host and distribute malicious files. The embedded JavaScript likely facilitates the download and execution of a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6245

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://brusroom.com/wp-content/plugins/super-forms/uploads/php/files/3a1ca24fbb837aefd1adf6732cefdcab/56655242349.pdf In PDF document text
    • https://shared401k.com/wp-content/plugins/super-forms/uploads/php/files/77b382597a4562e66d1a025be9b18fe4/nuwogexekolizew.pdfIn PDF document text
    • http://localhomesales.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16078a5a9da19b---dagewodizunesazi.pdfIn PDF document text
    • http://chandigarhdatarecovery.com/files/file/92566381199.pdfIn PDF document text
    • https://karapinarinsaat.net/userfiles/upload/file/bewivapazaramonekud.pdfIn PDF document text
    • https://quangcaonoithatgiahung.com/admin/webroot/upload/image/files/71791257919.pdfIn PDF document text
    • https://galerie-louise.be/userfiles/files/69998825738.pdfIn PDF document text
    • https://faresaldabbous.com/uploads/files/rupexituvubebipuna.pdfIn PDF document text
    • http://xperion.hu/wp-content/plugins/super-forms/uploads/php/files/140ca52a468d39bfebc169303506e7d1/8576755701.pdfIn PDF document text
    • https://plasy.com/uploads/file/fuzolekuvokananiviju.pdfIn PDF document text
    • http://leilehua76.com/clients/4/4d/4d80c013f15dbe3c797666a457780dca/File/37840306929.pdfIn PDF document text
    • http://www.mediacomriccione.it/wp-content/plugins/formcraft/file-upload/server/content/files/1608c65ad1cd73---gapebuvisudizajep.pdfIn PDF document text
    • http://ingegneriarossi.it/userfiles/files/wugapunewag.pdfIn PDF document text
    • https://botorka.ro/userfiles/file/futuvobapujeniw.pdfIn PDF document text
    • https://basisnomor.com/contents//files/45490725241.pdfIn PDF document text
    • http://www.marcelasemper.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e67755cd24---47500481144.pdfIn PDF document text
    • http://autosvanbeek.nl/mindcms/js/ckf/userfiles/files/78098635143.pdfIn PDF document text
    • https://victorybear-info.com/userfiles/files/tabizakevikixu.pdfIn PDF document text
    • https://encouragingmath.com/wp-content/plugins/super-forms/uploads/php/files/9a65ade6948c0451d652eaee5fe4fead/kasibamumimizaziraval.pdfIn PDF document text
    • http://stroynerud-sm.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160b5f58f0ab5f---54328485960.pdfIn PDF document text
    • https://dfa-finanz.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607dd23e09215---farosetekonorapa.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/1xuhb7AK25c/uplcv?utm_term=geography+chapter+5+class+6+question+answerPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00035d44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x35D44 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0003755b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3755B 11440 bytes
SHA-256: 836e4eb8b48709eab123ace72008f2d89cc20f8ebf812a19b5b3f588a0ca6a27

Open this report in the interactive analyzer, or submit your own file for analysis.