Malicious PDF — malware analysis report

Static analysis result for SHA-256 15900e7e9152a753…

MALICIOUS

PDF

202.0 KB Created: 2021-07-19 05:10:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 03d49c703b9be2d24e7592839966e0ef SHA-1: 04c64149530d0d5c331e2cf5901c7a7fd160b4c4 SHA-256: 15900e7e9152a7533c09ec80c05bf07809bfe4f5af5bb72e1ac9906d06e8d1a8
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous links to compromised WordPress sites, suggesting a phishing lure or a distribution point for further malicious content. The presence of embedded URLs and the nature of the heuristics strongly suggest an attempt to redirect the user to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9619

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mkting.com.co/wp-content/plugins/super-forms/uploads/php/files/9aec7e7d2b6ce3e70afaa5d73be75f26/vasijefolagovapogowobav.pdf
    • http://www.vivelamusica.es/wp-content/plugins/formcraft/file-upload/server/content/files/160ee5aee5ba5f---riwudogulipamifetuj.pdf
    • https://2-view.org/home/view/public_html/ckfinder/userfiles/files/15720499730.pdf
    • https://laihouston.com/wp-content/plugins/super-forms/uploads/php/files/713f00c9cfb3db0a2b66d04e4b74963e/60673747803.pdf
    • http://ahchala.com/img/file/baxeduzowekejufunej.pdf
    • https://aguiapromocional.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b07ed27813d---57683823304.pdf
    • http://www.hkqi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072c4d9c713f---11822933994.pdf
    • http://nhs71.com/clients/d/d9/d9c6bfbc4bbdd207836d30c01fe5869c/File/6961970274.pdf
    • http://karthikeyanjayaram.com/userfiles/file/sigofurelep.pdf
    • http://beveragesgs.com/userfiles/file/kalisivejuliwitip.pdf
    • https://avayemehr-carpet.ir/data/file/51747929644.pdf
    • http://przychodnia-felinskiego.pl/uploads/editor/file/taxiwumimefut.pdf
    • https://apoiotelecom.com/imagens/img_fckeditor/file/fonadorobulepisena.pdf
    • http://www.whirlpool-beachcomber.at/wp-content/plugins/formcraft/file-upload/server/content/files/16085c066d173c---21611402343.pdf
    • http://aydinservis.com/ckfinder/userfiles/files/ludap.pdf
    • http://zawayakw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160716d28d2481---78799631940.pdf
    • http://jhsclassof63.com/clients/c/c8/c8cc7cee7579ddcd469b669c0eb172d8/File/sadubumobepata.pdf
    • https://razdolle.by/wp-content/plugins/super-forms/uploads/php/files/9s7qlft0bkuhrc6q715lml39q4/befexut.pdf
    • https://camile.vn/wp-content/plugins/super-forms/uploads/php/files/okq9lkjj24ga800paatoqe89vd/feditawonoli.pdf
    • https://www.golddustdental.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a5670a54c99---38171875581.pdf
    • http://ciskmv.com/css/file/51402619886.pdf
    • http://traditionsradio.com/wp-content/plugins/super-forms/uploads/php/files/1v3g0st7aejfrqp4k6agv5fa52/jawiroz.pdf
    • http://teenaramainc.org/clients/875997/File/95162444921.pdf
    • http://www.loockuniformes.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/160f18a331d9f3---64083051751.pdf
    • http://myucpb.net/userfiles/file/wupakuretajubifamemenito.pdf
    • http://toshiba-center.ru/uploads/files/sitowunivazati.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/Om9ozkHLxGw/uplcv?utm_term=ice+cube+married
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002b4f4.bin
700ae6bb84d5eb272106e432975826a1d91162959135c135bf03e5a571d4dba5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2B4F4 10188 bytes
font_01_sfnt_off0002cbbe.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2CBBE 16792 bytes
font_02_sfnt_off0002e3d0.bin
82108b466c39cfd8cca2142186d5177bf478f1ef0e629fb3f1e5f15aa5fd4518		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E3D0 19920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.