Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf39844d94b21524…

MALICIOUS

PDF

77.6 KB Created: 2021-06-20 20:30:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c44f86497bdbe1710d260442d5ba48c9 SHA-1: a6acf03958a3e3a74b3c9c7f5de1b3c6e4493129 SHA-256: cf39844d94b21524e389d02686b317beffaec10c0b43e6426794ff77741300ff
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many pointing to compromised WordPress sites, suggesting a link farm designed to redirect users to malicious content. While no scripts were explicitly extracted, the presence of these links and the overall heuristic firings strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8029

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://profisystem.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1608e29ae6faad---98150990831.pdf
    • https://jclifeschools.org/wp-content/plugins/super-forms/uploads/php/files/5653b9fa043fc5576e28a8e8a2f113c7/23838856845.pdf
    • https://www.financedeclined.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16085873a32174---momegeburugatokapizaw.pdf
    • https://ifacemount.com/wp-content/plugins/super-forms/uploads/php/files/0eqe7mchlfelj3lvn7cj7tuo4s/fibuga.pdf
    • http://xn--o39a91gvwm83kbsn.com/FileData/ckfinder/files/20210617_3FFCE15E184C3582.pdf
    • https://mithermomix.com.mx/wp-content/plugins/super-forms/uploads/php/files/ac24c94fc674d0286a00768b2a10d8bc/dinibuguvujofelarorovox.pdf
    • https://mavismanagement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bd8e0192f25---4030729272.pdf
    • https://brandonsmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/75tvp43re49mk9hn5d7multtm5/dexazuwizunakaxanu.pdf
    • http://aberdeeneyes.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1609129f6cb179---57736447871.pdf
    • https://www.sevgiliyevideo.net/wp-content/plugins/formcraft/file-upload/server/content/files/1609b93c3ebfee---gofikimegar.pdf
    • http://www.brennholz-heinlein.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606d8122ee232---16370871535.pdf
    • http://iamsoldierfit.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a479a4d12c7---zilege.pdf
    • http://chinamakina.com/userfiles/file/sikatomam.pdf
    • https://esportenerd.com/app/webroot/ckfinder/userfiles/files/66797581080.pdf
    • http://inspirationallabels.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606cbb8a653b8---dobozor.pdf
    • https://jaunimodienos.lt/wp-content/plugins/super-forms/uploads/php/files/lf1h9c6abm1j1qmb29a64icb0l/bosixagamikijufatokuwotek.pdf
    • http://tubietelbar.hu/uploadfile/22775262066.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=plant+versus+zombie+2+hack
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3b4.bin
d8b9f0e46c11428cd084d7f8e4b46b2cf931203ee8483160b08be0cd72b90e49		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3B4 3912 bytes
font_01_sfnt_off00010191.bin
b66e52e4ae9ba09b30ffc8a1fbd65795eb7c6686ba03f5a02641fdb8ce62fd7d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10191 5368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.