Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a4507d1b03ccff7…

MALICIOUS

PDF

116.4 KB Created: 2021-06-28 19:58:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24
MD5: d74295f4b1f18b20954fa279705b6b2d SHA-1: 671b891a883d2529c367c0e5213261ffdf8cf936 SHA-256: 1a4507d1b03ccff7c26e55055c9e7d64fc893f34cec90e131952b4660c1375f7
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

This PDF file was detected as malicious by ClamAV and an ML classifier. The 'SE_CLIPBOARD_COMMAND_LURE' heuristic indicates the document instructs users to copy and paste commands into a shell, a common tactic for executing malicious payloads. Multiple URLs pointing to compromised websites and link farms suggest this document is part of a phishing campaign designed to lead users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9929

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/uplcv?utm_term=command+prompt+manual PDF link annotation
    • http://europeanprofservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c8172096ce---47701032717.pdfIn PDF document text
    • https://sv-fin.ru/wp-content/plugins/super-forms/uploads/php/files/5f2d1b707b624eaac267167369faee39/42472628647.pdfIn PDF document text
    • https://www.vigo.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160829daa36281---lujimep.pdfIn PDF document text
    • https://www.peeryhotel.com/wp-content/plugins/super-forms/uploads/php/files/19a02bbd6572cda14f5f8d68a2e998c4/35524616972.pdfIn PDF document text
    • http://www.agrosystem.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160a7589cf3edf---17183012322.pdfIn PDF document text
    • http://akcjonariusz.com/UserFiles/file/kebof.pdfIn PDF document text
    • http://omonetach.pl/foto/ilustracje/file/powutupijozab.pdfIn PDF document text
    • https://www.themeshcowork.com/wp-content/plugins/super-forms/uploads/php/files/6ff074d7b2f37ddabd75deb8a696df17/52816150071.pdfIn PDF document text
    • https://parisautotravel.com/wp-content/plugins/super-forms/uploads/php/files/8mmktgemvf85ncfd0qhhcuf950/ruloluzamemibupen.pdfIn PDF document text
    • http://www.highlandmetals.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160aa01458c9ad---zumes.pdfIn PDF document text
    • https://www.birdandwildlifeteam.com/wp-content/plugins/formcraft/file-upload/server/content/files/160946772d09c6---64975507333.pdfIn PDF document text
    • http://cedule-plachty.cz/files/file/negelobotezopukiz.pdfIn PDF document text
    • https://prikolnaya.com/wp-content/plugins/super-forms/uploads/php/files/b8acc222883d907b9a2b662b764d91bb/75101338672.pdfIn PDF document text
    • https://sport-jicin.cz/dokumenty/34590691588.pdfIn PDF document text
    • https://genesisbehaviorcenter.com/wp-content/plugins/super-forms/uploads/php/files/2fa00924373804fa1ca4b0e65368f3e3/juganikufasidiniwaj.pdfIn PDF document text
    • https://www.financedeclined.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160ac9586e91b4---fivosagikidabenirikuner.pdfIn PDF document text
    • http://czdashan.cn/uploadfile/file/2021052620112473499.pdfIn PDF document text
    • http://dansensvenner.dk/imagesfile///30471682557.pdfIn PDF document text
    • http://www.kidnuri.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b81eeda2ecf---42768922659.pdfIn PDF document text
    • https://extremetour74.ru/wp-content/plugins/super-forms/uploads/php/files/2759b04ac27ac7ba7a4d7025cffc24c7/64357991925.pdfIn PDF document text
    • https://dalton-english.com/userfiles/file/gisagivibemugodotin.pdfIn PDF document text
    • https://www.kiteschule-eckernfoerde.de/wp-content/plugins/formcraft/file-upload/server/content/files/160906c8420dcf---29888340964.pdfIn PDF document text
    • https://rhagro.com.mx/wp-content/plugins/super-forms/uploads/php/files/ed5dd73ce3f8890c0774068e1701eac9/80099744904.pdfIn PDF document text
    • https://sakitonus.ru/wp-content/plugins/super-forms/uploads/php/files/563ecd665e751ab1d7cd45697e7c2d8f/kefafobavufunitifasiwaw.pdfIn PDF document text
    • https://soalmatematik.com/userfiles/file/vudanezugumezozu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014f22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14F22 16068 bytes
SHA-256: 6d636ebcb28a43c11a0b96216d988d0aaa25e428b847d4e039b2a2a6b6e27b6d
font_01_sfnt_off0001643e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1643E 18140 bytes
SHA-256: 42547dfac02614cd0fe289eeab5fba2e13f015db9e1f819047dcc0e26ae56bbf
font_02_sfnt_off0001949c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1949C 10292 bytes
SHA-256: d1d7665e25891d236496f559b44032c3e32cb733f0cdad065c8672efcbd8f6bc
font_03_sfnt_off0001abbe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1ABBE 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.