Malicious PDF — malware analysis report

Static analysis result for SHA-256 11e81e9b6249e9a5…

MALICIOUS

PDF

88.5 KB Created: 2021-08-07 05:38:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24
MD5: fea75b5d1838ad753da274a3de39a223 SHA-1: cc6e01bca84c8d9b84f73ee7a657f61add727f86 SHA-256: 11e81e9b6249e9a5fefeef49e1e0ad95dd55e9174653ad8166faa6fde56f65c9
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1190 Exploit Public-Facing Application

The PDF contains embedded JavaScript and multiple external links, many of which point to compromised CMS uploads. The document body, though heavily obfuscated, contains a URL that impersonates Apple and prompts the user to reset their password, indicating a credential phishing attempt. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9919

Heuristics 8

  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://crewmak.ru/uplcv?utm_term=how+to+reset+apple+id+password+without+email+and+security+questions.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/uplcv?utm_term=how+to+reset+apple+id+password+without+email+and+security+questions PDF link annotation
    • http://kursadowicz.pl/Upload/file/1449747702.pdfIn PDF document text
    • https://nobleanimalsanctuary.org/wp-content/plugins/super-forms/uploads/php/files/tmp/gopevanobobiseradevoke.pdfIn PDF document text
    • http://atlantichomeportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ddf3a850f1e---30970472511.pdfIn PDF document text
    • http://southport1969.com/clients/861680/File/lazojomed.pdfIn PDF document text
    • https://prana.video/wp-content/plugins/super-forms/uploads/php/files/kspi88rhosvv5snaitae25p0qf/xewamawufutafawesizegekez.pdfIn PDF document text
    • http://jagatjyotischool.org/jagatjyotischool/userfiles/file/kuzitilekewamelidixexaf.pdfIn PDF document text
    • https://comodee.com/wp-content/plugins/formcraft/file-upload/server/content/files/160be1507da9ca---woregetot.pdfIn PDF document text
    • http://kme-kme.cz/files/file/zenunelevi.pdfIn PDF document text
    • https://xn--80adj7cxa.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/50bc806214cc00586ca692a4038aae34/zazog.pdfIn PDF document text
    • http://audiomaster.se/wp-content/plugins/formcraft/file-upload/server/content/files/160d636117278c---90257910972.pdfIn PDF document text
    • http://meadescafe.com/userfiles/file/71260863690.pdfIn PDF document text
    • https://www.espymetcalf.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a746efe5494---93654463045.pdfIn PDF document text
    • https://www.generalutilities.com/wp-content/plugins/formcraft/file-upload/server/content/files/16085ec1c594a7---14300231115.pdfIn PDF document text
    • https://skillmapmagazine.com/ckfinder/userfiles/files/39692865541.pdfIn PDF document text
    • https://www.cibaospalaser.com/wp-content/plugins/super-forms/uploads/php/files/khr6kp8f72pu11jhp59mi320qn/23425580477.pdfIn PDF document text
    • http://inspirationallabels.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1607e71620bc8b---nigufeduzum.pdfIn PDF document text
    • http://securitydirect.it/wp-content/plugins/super-forms/uploads/php/files/27234044508587ac0f3eebdd42e6cbf9/mulaxo.pdfIn PDF document text
    • http://skyrunarser.com/js/fckeditor/editor/filemanager/connectors/php/connector.php/upfiles/file/2107280148139797015g975b.pdfIn PDF document text
    • http://cosonhuath.com/hinhanh_fckeditor/file/nuragiwifonaz.pdfIn PDF document text
    • https://aymfly.com/aym_image/files/petifufuparape.pdfIn PDF document text
    • https://selapro.com.au/application/third_party/ckfinder/userfiles/files/7018602935.pdfIn PDF document text
    • https://frasertechno.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609646a07f287---41935031428.pdfIn PDF document text
    • http://charmingcurls.se/upload/file/bizesubu.pdfIn PDF document text
    • https://g-ortho.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160ae5fc55ff44---vojobejetabasiliwabuvuro.pdfIn PDF document text
    • https://teenvolunteerdallas.org/wp-content/plugins/super-forms/uploads/php/files/3d287a95f17a2a21c32ffd296ae09eac/kumenukimizawadozoninenog.pdfIn PDF document text
    • https://g-ortho.com.br/wp-In macro / runtime command snippet
    • https://mediacentre.aerlingus.com/js/ckfinder/userfiles/files/18045689669.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee6f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE6F 18232 bytes
SHA-256: bb2416bb085d3128abb217bacad20e429d1dd13d693ee9290a73b5ef6e614b2e
font_01_sfnt_off00011e7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E7B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00013692.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13692 11216 bytes
SHA-256: fe2a6cce361ff2d257228b1a1fd1a48e1d5c9eeb294a43403a9dc8ba0b6063d2

Open this report in the interactive analyzer, or submit your own file for analysis.