Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d2c97b6c530ca6f…

MALICIOUS

PDF

82.0 KB Created: 2021-09-02 03:55:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: bd0975786b902607a6ff48ed44bbe94d SHA-1: b2ce88b6a16c47e43fea4a01a4777328550a36c1 SHA-256: 1d2c97b6c530ca6f142e688ebac7d9f472951e76b877465cf33b266cf08cf988
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains heuristics indicating it is a link farm hosted on compromised WordPress sites, with a high ML classification for maliciousness. A key finding is the 'SE_CLIPBOARD_COMMAND_LURE' heuristic, suggesting the document instructs users to copy and paste content into a command-line interface. This is a common technique to bypass initial security measures and execute malicious commands, likely to download and run a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9946

Heuristics 6

  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://donghozibistore.com/luutru/files/biwubegafudagupuxudal.pdf In PDF document text
    • https://www.penyembuhanholistikreiki.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608433a39b650---togisali.pdfIn PDF document text
    • https://noukos.gr/wp-content/plugins/formcraft/file-upload/server/content/files/1608714a4d9af7---54652569548.pdfIn PDF document text
    • https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/ln0a21snu4qq19btqd3kp709to/sobadi.pdfIn PDF document text
    • https://www.hungarianassociation.com/wp-content/plugins/formcraft/file-upload/server/content/files/16103add6e17d1---39558435288.pdfIn PDF document text
    • https://tradegateindia.com/userfiles/file/18982147832.pdfIn PDF document text
    • https://bizdrive.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/160aab52876bc8---153150038.pdfIn PDF document text
    • https://webvitamin.vn/app/webroot/uploads/files/19412132161.pdfIn PDF document text
    • https://amblamy.ee/upload/file/11901779291.pdfIn PDF document text
    • https://chamsocmuihong.com/wp-content/plugins/super-forms/uploads/php/files/72l32klmlqq42jm87k8p8fnf4g/62911788429.pdfIn PDF document text
    • https://gtselect.fr/ckfinder/userfiles/files/gelefijugusilof.pdfIn PDF document text
    • http://wingmanplanningdemo.com/userfiles/files/12915556084.pdfIn PDF document text
    • https://www.okcfarmersmarket.com/wp-content/plugins/super-forms/uploads/php/files/8cab516078704cdee1b1e13eab46986b/387537529.pdfIn PDF document text
    • https://www.officinadelgustoroma.com/wp-content/plugins/super-forms/uploads/php/files/cd20dce0e8fdf405f2d74aeccac83f71/lapudukosajerefuban.pdfIn PDF document text
    • http://chagatea.ru/wp-content/plugins/super-forms/uploads/php/files/53e1a999167fd6daf1909c20101817db/pixobirazopebemulax.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16114fc7dd2111---85212208159.pdfIn PDF document text
    • http://veszpremlizards.hu/_user/file/miripolegevirutebupukenag.pdfIn PDF document text
    • http://beckydavidsonhomes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609576c2bbb93---fubugilivib.pdfIn PDF document text
    • http://taeguektour.com/FileData/ckfinder/files/20210822_6092742EA68F73E7.pdfIn PDF document text
    • http://sosnovgeo.ru/userfiles/file/99931018465.pdfIn PDF document text
    • https://realwebguys.com/wp-content/plugins/formcraft/file-upload/server/content/files/160897f94af98c---bidukolitapikenuvexedode.pdfIn PDF document text
    • http://suaups.net/userfiles/file/58342905838.pdfIn PDF document text
    • http://www.recetasyconsejos.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610b16349f6c5---xoratudinedaxawuxo.pdfIn PDF document text
    • http://niezapominajkowo.eu/userfiles/file/pavoxuwodazobixavixu.pdfIn PDF document text
    • http://ipvoicenj.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609425458b562---rosokezuloz.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/fzgW7-mxBc0/uplcv?utm_term=how+to+get+rid+of+your+windows+license+will+expire+soonPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD7EE 18272 bytes
SHA-256: 100e020a5d7810ab494f128c828a342a7d605cfb69107d8eecebd66d15231ee0
font_01_sfnt_off0001069b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1069B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00011eb2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11EB2 11028 bytes
SHA-256: 0ec17f9852bcede2dfeaa4f083f23171122981751468e0cb7bcadaf046beaf3d

Open this report in the interactive analyzer, or submit your own file for analysis.