Malicious PDF — malware analysis report

Static analysis result for SHA-256 23d77b886c8fcc1b…

MALICIOUS

PDF

95.9 KB Created: 2021-06-26 08:49:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25
MD5: 6fdd1776b8925738559fb44e5fedc9e0 SHA-1: 7bbdcb6bb8663e6470f0d83aa45b22bd61706c92 SHA-256: 23d77b886c8fcc1bc9f61d7368ca0838f7473bd20f229bf80f3e8b32f085c59f
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ML classifier and ClamAV detection strongly indicate maliciousness. The PDF contains a link farm pointing to compromised WordPress upload storage, suggesting it's part of a phishing campaign. The 'SE_CALLBACK_LURE' heuristic confirms the document's intent to trick users into calling a phone number for fraudulent purposes, likely related to fake billing or support scams.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9929

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kardelendalgicpompa.com/uploadfiles/file/seborowepubez.pdf In PDF document text
    • https://amiablediamonds.com/wp-content/plugins/super-forms/uploads/php/files/418d6d294e85a373ad24cc87d70bca79/dusilozugiti.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160838da9bc30c---54669068064.pdfIn PDF document text
    • https://alenakovalchuk.ru/wp-content/plugins/super-forms/uploads/php/files/f8fada742679e8c99c4971575e2b40c7/73746023831.pdfIn PDF document text
    • http://www.myhhsi.com/wp-content/plugins/super-forms/uploads/php/files/333ca770ebfca63a3434dd001d45ba57/87738531474.pdfIn PDF document text
    • http://bright-mineral.com/uploadfile/file/2021062317074142.pdfIn PDF document text
    • https://www.hotel-palladium.gr/wp-content/plugins/super-forms/uploads/php/files/2en0o2vkpd3dkevqnqer1rg12d/69947739972.pdfIn PDF document text
    • http://www.skup.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607e08e5cedcd---bovosusawuwiwatagab.pdfIn PDF document text
    • https://machinex-machines.com/UserFiles/File/44127433317.pdfIn PDF document text
    • http://naturallabs.de/userfiles/file/pematumapijutapi.pdfIn PDF document text
    • http://ourjamesfamilyhistory.com/clients/1/14/146a9f92d0a296c7c29e793db058bb30/File/pavuzixexaguza.pdfIn PDF document text
    • http://global-leasing-management.com/uf/file/borofimawapuzawusuw.pdfIn PDF document text
    • http://slowjamsundays.com/wp-content/plugins/formcraft/file-upload/server/content/files/160831c65b705f---raroxotadawesuz.pdfIn PDF document text
    • https://foodvellythailand.com/upload/files/51136369429.pdfIn PDF document text
    • http://doubletroubels.com/wp-content/plugins/formcraft/file-upload/server/content/files/160744ab37313a---43380699099.pdfIn PDF document text
    • https://noble-worldwide.com/wp-content/plugins/super-forms/uploads/php/files/f0d0f846fd416fb3269c4d6e3caf3b94/dukabijax.pdfIn PDF document text
    • http://studiopignotti.it/userfiles/files/delori.pdfIn PDF document text
    • http://kibbkw.com/uploads/file/detuvowurukisewaroteb.pdfIn PDF document text
    • https://portsidestrategies.com/wp-content/plugins/super-forms/uploads/php/files/fd3dc1ef6d2d8d15518ab973b2d62430/40834584992.pdfIn PDF document text
    • https://sharidendesignasphalt.com/wp-content/plugins/super-forms/uploads/php/files/a316e86013ac9b9a9e620f2fd993785d/16331737481.pdfIn PDF document text
    • https://www.frankcapassoandsons.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b7e448f1689---72259333418.pdfIn PDF document text
    • http://szkolka-wiercioch.pl/files/file/levevinulupefabotozex.pdfIn PDF document text
    • http://homelife-superstars.com/image/files/48645354687.pdfIn PDF document text
    • http://bmsorganica.com/userfiles/file/bovesufisavunafewulu.pdfIn PDF document text
    • http://mai-colle.jp/userfiles/file/toxutelagatoxuk.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/PmAiG5ZyT-k/uplcv?utm_term=general+knowledge+questions+for+a+10+year+oldPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011159.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11159 17548 bytes
SHA-256: 68d5fb8e2895b34e596accfdaaff089da1e3352f2b243f9965fabb5552f94dfc
font_01_sfnt_off00013f8a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13F8A 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000157a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x157A1 11280 bytes
SHA-256: 091b1f2f40c9755cbeecab19a31ea609318d9094915c2f9b0026ebec7272a5ab

Open this report in the interactive analyzer, or submit your own file for analysis.