Malicious PDF — malware analysis report

Static analysis result for SHA-256 20f1d7492f5fbee7…

MALICIOUS

PDF

200.2 KB Created: 2021-07-03 21:29:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-13
MD5: 523953460527256eea4380adb9d91a51 SHA-1: c582dc9c8025387bb8c4c32214d92f0a86a95a4f SHA-256: 20f1d7492f5fbee75c654abd7cbdb98ed713afcb50f690031820b87e35cdd640
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or malware distribution attempt. It contains a link farm pointing to compromised WordPress upload directories, suggesting an effort to host malicious content on seemingly legitimate but compromised sites. The presence of PRC/3D content and external URI references further supports its role as a lure or delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9806

Heuristics 7

  • PRC/3D content in PDF medium CVE related PDF_PRC_3D
    PDF contains PRC 3D content. PRC/U3D parsers have been a recurring Adobe Reader attack surface; treat as a related parser-exploit indicator rather than a specific CVE match.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wentworthre.com/wp-content/plugins/super-forms/uploads/php/files/1d46c9946a343dfc59742f0492ab499e/60492868551.pdf In PDF document text
    • https://www.reachcast.ca/wp-content/plugins/super-forms/uploads/php/files/9a3ab4ddfd3c8b326e7f8110ad2ca756/60943092480.pdfIn PDF document text
    • https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b80ee525f1---75069995052.pdfIn PDF document text
    • http://banphimchuot.com/userfiles/file/jojasedudabunomidetexozu.pdfIn PDF document text
    • https://yarsan.ru/wp-content/plugins/super-forms/uploads/php/files/c4ec094573f05cbc1d2e6bf78b512c2b/14051066419.pdfIn PDF document text
    • https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/160b7700a3dca3---kabevemexapazivapakegeno.pdfIn PDF document text
    • http://admio.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1607f814ab5e4c---27796985130.pdfIn PDF document text
    • https://www.chinacimctrailer.com/wp-content/plugins/super-forms/uploads/php/files/69f63edabe2e6fa48d4d26f325e902ef/nenebajefewupipubowexan.pdfIn PDF document text
    • http://www.bewegeninarnhem.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160d43a94560ba---demowexikazubumafoxado.pdfIn PDF document text
    • http://www.kliningstroy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160a7f6edb8b84---23676437585.pdfIn PDF document text
    • http://ilovegabal.net/fckeditor/_upload/file/xutopunizokoliwijimofuba.pdfIn PDF document text
    • https://alcc.vn/wp-content/plugins/super-forms/uploads/php/files/lk81n7svab54bukrh5ontjqe91/8060939069.pdfIn PDF document text
    • http://planetamama.ru/files/file/loxanu.pdfIn PDF document text
    • http://antifftech.com/uploadfile/file///2021050104200664.pdfIn PDF document text
    • http://www.jesuseslaroca.org/wp-content/plugins/formcraft/file-upload/server/content/files/16085c513db761---6766661143.pdfIn PDF document text
    • http://www.expertnutritionadvisor.com/wp-content/plugins/formcraft/file-upload/server/content/files/16088619263c3e---nitukamugomi.pdfIn PDF document text
    • http://www.fullertherapy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e1d2e4fadd---febeguvekujiderurakarun.pdfIn PDF document text
    • https://www.stamfordtaxis.com/wp-content/plugins/super-forms/uploads/php/files/thnbst84jbmsj4el1urj6oj876/97948557209.pdfIn PDF document text
    • http://www.alwaysflorida.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b0ffa5834d8---42817493356.pdfIn PDF document text
    • https://rebates.forex/wp-content/plugins/super-forms/uploads/php/files/9do3n6usjf8hvi7r5p0mk73ha5/bikab.pdfIn PDF document text
    • https://eprobatdz.com/ckfinder/userfiles/files/22982330361.pdfIn PDF document text
    • http://escolacaritas.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bea32d7d4e8---71994633019.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=prehistoric+and+ancient+egyptian+paintingPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002b027.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B027 10860 bytes
SHA-256: 71f72404e035f68e59007bb659f1c1a474fd73db1ed1dfa2a1f0a91c59f335b6
font_01_sfnt_off0002c90b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C90B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0002e11d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E11D 20340 bytes
SHA-256: 34ca209f6ca1399038f80707dcb57f9a621a09fa318ce40cca5afe3470aa30a8

Open this report in the interactive analyzer, or submit your own file for analysis.