Malicious PDF — malware analysis report

Static analysis result for SHA-256 133808fdcb383bb1…

MALICIOUS

PDF

82.2 KB Created: 2021-09-07 17:02:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: 9802712eb6c91110e56f7eb42a48996a SHA-1: e64f386b94bb057abcc325076b13ec67a9005786 SHA-256: 133808fdcb383bb1ac3c1d3e2bc4db9362bbac4fab9915a1e90241d545e2bcb5
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The 'SE_BROWSER_INSTALL_LURE' heuristic strongly suggests the document is designed to trick the user into downloading and installing malicious software by posing as a necessary browser update or plugin. Several URLs were extracted, some hosted on potentially compromised CMS uploads, which could serve as download locations for further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kovacsoltvaskerites.hu/images/file/jufifumam.pdf In PDF document text
    • http://sharon-barron.com/userfiles/files/72380439676.pdfIn PDF document text
    • https://mashura.co/userfiles/files/nazosawunafedaguz.pdfIn PDF document text
    • https://uat-tunisia.com/userfiles/file/98572135413.pdfIn PDF document text
    • http://tks-forever.com/upload/2021/06/27/file/34132764011.pdfIn PDF document text
    • http://richfield1960.com/clients/865265/File/89927650216.pdfIn PDF document text
    • https://www.beewellrx.com/wp-content/plugins/super-forms/uploads/php/files/tmp/zigusujijupogijotoxuja.pdfIn PDF document text
    • http://mobydick-band.de/fckdata/file/bupejuger.pdfIn PDF document text
    • https://www.mftelhas.com.br/adm/Editor/ckfinder/userfiles/files/wominuvedowakomagigosir.pdfIn PDF document text
    • http://ducnhua.com/upload/files/3084196005.pdfIn PDF document text
    • http://balade-pierry.fr/userfiles/file/70404620078.pdfIn PDF document text
    • https://m-co.de/wp-content/plugins/super-forms/uploads/php/files/bvqecgeemgqtlbeq3p2mocn9rq/vuzogorok.pdfIn PDF document text
    • http://uamarkets.com/images/file/18935100251.pdfIn PDF document text
    • https://www.gasserbush.com/wp-content/plugins/super-forms/uploads/php/files/8a240fd407ca89cdac99b0a43dcdd14e/dajujudozum.pdfIn PDF document text
    • http://albatrossmrn.com/konadnew/userfiles/file/kexogawivogifarujoru.pdfIn PDF document text
    • https://oneremote.ru/wp-content/plugins/super-forms/uploads/php/files/eac98975fb6b988341d4e2f9121ebde7/52007133058.pdfIn PDF document text
    • https://shrmivirtual.org/wp-content/plugins/super-forms/uploads/php/files/10b60e63173cee807f292c80bf3be9cd/tusemapipanobo.pdfIn PDF document text
    • https://aartipalette.com/userfiles/file/pokewaguxugivitojijenina.pdfIn PDF document text
    • https://alexandrapanayotou.com/web/images/static/file/32020995251.pdfIn PDF document text
    • http://falegnameriacastiglione.it/userfiles/files/72832824331.pdfIn PDF document text
    • http://www.tenniscanberra.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16072eec3891ea---62289703938.pdfIn PDF document text
    • http://andersonlawdecorah.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/48712504690.pdfIn PDF document text
    • http://microsolder.hu/userfiles/files/xevirif.pdfIn PDF document text
    • http://xn----8sbpvg0afdbe.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/5kiau57lugecm4ghij5kgmi722/nopisezimevazimi.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/3vuEKuznOb8/uplcv?utm_term=save+word+doc+as+pdf+with+active+linksPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD7B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000f58d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF58D 16932 bytes
SHA-256: c84f26c4f6b5174a4294ed109d4898e10cba9b7de730b05fc5deceb5859b0fff
font_02_sfnt_off000121ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x121BA 11036 bytes
SHA-256: 327060dac1be451bc5385f6343dff00898fc8f22629f9f4461a98a99c4fc0116

Open this report in the interactive analyzer, or submit your own file for analysis.