Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e1cace9bd3f9975…

MALICIOUS

PDF

215.7 KB Created: 2021-08-17 21:44:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05
MD5: c2e5276b049729d36dc5949d9f4a5af3 SHA-1: f73f1ed4db71a56d42946edca7d52b58292c4a67 SHA-256: 2e1cace9bd3f9975eb9e78d725c9759b22c99c6be77ecea5542596fa124bd029
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. It contains numerous embedded URLs, one of which points to a compromised WordPress upload directory. The ML classifier also indicated a high probability of maliciousness. While no scripts were explicitly extracted, the presence of these indicators suggests the document is designed to lead the user to a malicious site, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7061

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ecofincas.net/ckfinder/userfiles/files/rokibitunasa.pdf In PDF document text
    • https://loan-financial.com/wp-content/plugins/super-forms/uploads/php/files/45c6cedd0eaca3e1d88bc4495485b41d/66519393328.pdfIn PDF document text
    • https://mzr-avocats.com/buddha/ckfinder/userfiles/files/57345001297.pdfIn PDF document text
    • http://fincasotilloviejo.es/files/sotillo/_repo/file/88293314903.pdfIn PDF document text
    • https://path.mn/userfiles/files/16169399595.pdfIn PDF document text
    • http://atlantichomeportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b5c34f0c42---56529520572.pdfIn PDF document text
    • http://jungvassar.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/63504422712.pdfIn PDF document text
    • http://xn--b1ahhafccpgkb2bxo.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/adcbc3a7f87ff653b49cf65126be48d6/xegowudelujimigubapoxa.pdfIn PDF document text
    • http://www.onekaddy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b0f0a75ae25---54690105510.pdfIn PDF document text
    • https://halobysciton.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d15a722d2e---pebuwebemaviw.pdfIn PDF document text
    • http://www.skup.it/wp-content/plugins/formcraft/file-upload/server/content/files/160a129cb052f0---91957786329.pdfIn PDF document text
    • https://vantainoidia.vn/ci/userfiles/files/93901274117.pdfIn PDF document text
    • http://a1climbing.com/userfiles/files/16877945160.pdfIn PDF document text
    • http://tsmsaldature.it/userfiles/files/pigej.pdfIn PDF document text
    • https://www.kalirich.com/wp-content/plugins/super-forms/uploads/php/files/mdlq2btns9e4kic3ei8mgg4j30/jezabesutipokalaw.pdfIn PDF document text
    • http://dohertylaw.net/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/81260016394.pdfIn PDF document text
    • http://redeyeldn.com/userfiles/file/godinaragudemalufa.pdfIn PDF document text
    • http://abhinavabhishad.org/userfiles/file/9721410345.pdfIn PDF document text
    • http://cetinelektrik.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160c669ab7d604---xiziviniz.pdfIn PDF document text
    • http://www.training4thefuture.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1608faf2a53b42---tufekorumesibevipa.pdfIn PDF document text
    • https://www.pfgpartners.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1608b2e2a3568d---35923032644.pdfIn PDF document text
    • http://www.lavalledesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b3885185d36---sexusujafiluboridigewe.pdfIn PDF document text
    • http://ztkammer.at/uploads/file/16089503828.pdfIn PDF document text
    • https://esz.jp/img/editor/files/65916872221.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/Om9ozkHLxGw/uplcv?utm_term=lloyd%27s+premium+bordereau+templatePDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00030ece.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30ECE 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off000326e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x326E5 10796 bytes
SHA-256: 81c90f30f7e32cf1afb8f4df9a65b447d1dd28506eba7778e2bfed3076331076

Open this report in the interactive analyzer, or submit your own file for analysis.