Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd1c0df40e309156…

MALICIOUS

PDF

63.7 KB Created: 2021-05-18 09:58:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 08dbb743ea38f24c947b936c11e86be4 SHA-1: 408be94cb9e4bbba05a4ddd877a2318a93bd0b23 SHA-256: cd1c0df40e309156bdd95c72f32f6c0b9faca6561f6ca27cab0f6c13acdc0afb
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or malware distribution intent. It contains a link farm pointing to multiple compromised WordPress sites, likely serving as a redirection mechanism to malicious content. The presence of external URIs and link farms suggests an attempt to lure users to external, potentially harmful, resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8701

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://certifiedmoversinc.com/wp-content/plugins/super-forms/uploads/php/files/e52fb118c30b0a72f1b2ba867ba43382/11043256494.pdf In PDF document text
    • https://provisionsinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ee3265330d---42170328990.pdfIn PDF document text
    • https://accesoriosalmayor.com/images/userfiles/file/xulipebabafinovuxuk.pdfIn PDF document text
    • http://www.realisthotel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609cc51d391cc---62453964370.pdfIn PDF document text
    • https://coachtourbusrental.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a14248e247f---rovip.pdfIn PDF document text
    • https://vdbergelectro.nl/wp-content/plugins/super-forms/uploads/php/files/9b75d6cfe724c1ffc0ff4265cb36eb43/tipatasagokada.pdfIn PDF document text
    • https://naseeha.org/wp-content/plugins/super-forms/uploads/php/files/72ef7d0e3ec23905c5321f814fddf5b4/90727608079.pdfIn PDF document text
    • http://www.stallionreadymix.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16070e1a6108b7---76809225750.pdfIn PDF document text
    • http://deurwater.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073b2428b3c1---wasutipoborabarifo.pdfIn PDF document text
    • http://www.infranetltd.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080124ceaa00---sawagimasebalodulinulosav.pdfIn PDF document text
    • http://amon-syotengai.com/userfiles/file/lufowozepor.pdfIn PDF document text
    • http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090ccd0e804b---2647203724.pdfIn PDF document text
    • https://baobihungphu.com/media/ftp/file/87634427579.pdfIn PDF document text
    • http://monkey-do.net/userfiles/file/79055995761.pdfIn PDF document text
    • http://jeugdopdewetenschapsagenda.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16086c21c4666f---pasuxitololivabotabivag.pdfIn PDF document text
    • https://anzmrrn.org/wp-content/plugins/formcraft/file-upload/server/content/files/16080e72a0ea29---piwosakeraxite.pdfIn PDF document text
    • https://iescolumbus.org/wp-content/plugins/super-forms/uploads/php/files/d69f1ea6a21a21dab79029c3cc92f924/topuvajuvegilowuga.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=%25D0%25BA%25D0%25BE%25D0%25BD%25D1%2582%25D1%2580%25D0%25BE%25D0%25BB%25D1%258C%25D0%25BD%25D1%258B%25D0%25B5+%25D1%2580%25D0%25B0%25D0%25B1%25D0%25BE%25D1%2582%25D1%258B+%25D0%25BF%25D0%25BE+%25D0%25B0%25D0%25BD%25D0%25B3%25D0%25BB%25D0%25B8%25D0%25B9%25D1%2581%25D0%25BA%25D0%25BE%25D0%25BC%25D1%2583+%25D1%258F%25D0%25B7%25D1%258B%25D0%25BA%25D1%2583+4+%25D0%25BA%25D0%25BB%25D0%25B0%25D1%2581%25D1%2581+%25D1%2581+%25D0%25BE%25D1%2582%25D0%25B2%25D0%25B5%25D1%2582%25D0%25B0%25D0%25BC%25D0%25B8+%25D0%25BA%25D1%2583%25D0%25B7%25D0%25BE%25D0%25B2%25D0%25BB%25D0%25B5%25D0%25B2In PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=%25D0%25BA%25D0%25BE%25D0%25BD%25D1%2582%25D1%2580%25D0%25BE%25D0%25BB%25D1%258C%25D0%25BD%25D1%258B%25D0%25B5+%25D1%2580%25D0%25B0%25D0%25B1%25D0%25BE%25D1%2582%25D1%258B+%25D0%25BF%25D0%25BE+%25D0%25B0%25D0%25BD%25D0%25B3%25D0%25BB%25D0%25B8%25D0%25B9%25D1%2581%25D0%25BA%25D0%25BE%25D0%25BC%25D1%2583+%25D1%258F%25D0%25B7%25D1%258B%25D0%25BA%25D1%2583+4+%25D0%25BA%25D0%25BB%25D0%25B0%25D1%2581%25D1%2581+%25D1%2581+%25D0%25PDF link annotation
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d88e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD88E 6460 bytes
SHA-256: ce7afdfd8dae0c9e989264717966c45c6212c6806dd7569eb6690faf220ffa40

Open this report in the interactive analyzer, or submit your own file for analysis.