Malicious PDF — malware analysis report

Static analysis result for SHA-256 18137277098d2fc2…

MALICIOUS

PDF

225.4 KB Created: 2021-08-23 11:11:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23
MD5: 1259eeb549e72e7b0ac3d72c962ee1f8 SHA-1: 1e4e15e1068832b1d72f8ffe6a426a865448cefe SHA-256: 18137277098d2fc2f0582c9e16eff4b7a26209fe5e208f89c3a529dcf1db47b2
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and multiple links, several of which point to compromised WordPress sites hosting PDF files. One link uses a raw IP address, indicating a potential attempt to obscure the malicious destination. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to deliver a further payload or phish for credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9831

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cheapmarkt.com/userfiles/file/rofare.pdf In PDF document text
    • http://texinpack.com/uploadfile/file///2021080722404247.pdfIn PDF document text
    • http://stphilomenaonline.org/userfiles/file/80160288840.pdfIn PDF document text
    • https://bf-pomosch.ru/wp-content/plugins/super-forms/uploads/php/files/rg97a4r872jni85r8o9e98scv7/47328756986.pdfIn PDF document text
    • http://bjaimama.com/data/upload/2021/05/file/202105210444342456.pdfIn PDF document text
    • http://viviapalermo.com/userfiles/files/dulib.pdfIn PDF document text
    • https://hopadive.cz/ckfinder/userfiles/files/gutimajerumibu.pdfIn PDF document text
    • http://vom-ragnaroek.de/uploads/file/xomafezotolaxeburidixeko.pdfIn PDF document text
    • http://www.oschouston.com/osc/wp-content/plugins/formcraft/file-upload/server/content/files/1609729cf645e9---gawuzas.pdfIn PDF document text
    • http://sun-green.de/ckfinder/userfiles/files/12910623367.pdfIn PDF document text
    • http://consulcongress.it/uploads/assets/file/mefiro.pdfIn PDF document text
    • http://go-trec.com/wp-content/plugins/super-forms/uploads/php/files/l3det373kekvjoeun0gnrlaokc/rurozawesur.pdfIn PDF document text
    • http://domeinbeverdonk.be/assets/files/file/losewexuperabutumatiw.pdfIn PDF document text
    • http://79.170.40.182/boothtastic.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bce3c558890---77314893560.pdfPDF link annotation
    • http://yourhealthyanswer.com/ckfinder/userfiles/files/bivaludamidelaxejusuwa.pdfIn PDF document text
    • https://iwnta.com/userfiles/file/16897211300.pdfIn PDF document text
    • http://cleanyachts.it/writable/public/userfiles/file/80859138858.pdfIn PDF document text
    • https://www.sensormaticltd.com/app/templates/js/ckfinder/userfiles/files/20746669210.pdfIn PDF document text
    • http://www.orarestauratorisaf.it/wp-content/plugins/formcraft/file-upload/server/content/files/16086be526d065---lufejafimubepejex.pdfIn PDF document text
    • https://www.mercedesbenzofaustinservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077e63e43847---fonafanunuzozegunatafo.pdfIn PDF document text
    • http://atenngo.com/admin/sites/site/documents/gatoberu.pdfIn PDF document text
    • https://yournew.site/wp-content/plugins/super-forms/uploads/php/files/a9rm7nmm1lkt8rv59ugj2vvdrn/47821203458.pdfIn PDF document text
    • http://e-hematologica.com/users//file/85883124502.pdfIn PDF document text
    • https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160adcf463f171---92989619994.pdfIn PDF document text
    • http://trackeg.com/en/wp-content/plugins/formcraft/file-upload/server/content/files/1607177a0324bf---79268554221.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=evidence+of+evolution+worksheet+answers+keyPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003163e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3163E 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00032e50.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32E50 17600 bytes
SHA-256: 0a058362ae78ee5c3e28470e0b8e8c511e074eda95fb6e9953e4b458147a26b7
font_02_sfnt_off00035ca1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x35CA1 11012 bytes
SHA-256: d8559b44daaec4d3867c15b5a7c34ce9492ecf599e542976324c1f3d8df0361e

Open this report in the interactive analyzer, or submit your own file for analysis.