Malicious PDF — malware analysis report

Static analysis result for SHA-256 30372c3ac9bd7aa1…

MALICIOUS

PDF

160.0 KB Created: 2021-06-26 05:56:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 012e552b2912b4d31740e1473b3b163d SHA-1: a604f4f5689487c2a74a191c359398704b1956fb SHA-256: 30372c3ac9bd7aa140cc7357e27b48ca222b7b1d6e262589cf198356be34cd36
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs, many pointing to compromised CMS upload directories, suggesting a link farm designed to redirect users to malicious content. The presence of a 'LOLBin token sequence' and ClamAV's detection as 'Pdf.Phishing.Trojan' strongly indicate a phishing or malware distribution attempt. The ML classifier also flagged this PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9733

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://coretry.ru/uplcv?utm_term=order+of+mass+in+tamil+pdf
    • https://baileyelectrical.services/wp-content/plugins/super-forms/uploads/php/files/kmcmddnuaag0frr8tn8ar4tdm3/tinureti.pdf
    • https://noihoithanhtuan.com/media/ftp/file/buxusivevezamapu.pdf
    • http://paradisetourkorea.com/FileData/ckfinder/files/20210614_1EA8C4C3DD87D438.pdf
    • https://actioncoach.com.my/wp-content/plugins/formcraft/file-upload/server/content/files/160b750abea5d9---dopumupiguga.pdf
    • http://creativeindustries.ru/uploads/userfiles/file/dewebuwolebovurovaruk.pdf
    • https://menu2uplus.com/images/file/15571093336.pdf
    • https://creativesilhouettes.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607780626b28a---jibekipimovudirosemobujig.pdf
    • https://benjamindreyer.com/wp-content/plugins/super-forms/uploads/php/files/35c12304a9624838a8262c36ac50a785/92449368885.pdf
    • https://www.avenueroadadvertising.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b82495d4051---juwesunixezukuzirisoxuwu.pdf
    • http://www.oschouston.com/osc/wp-content/plugins/formcraft/file-upload/server/content/files/1609b1ff8269a0---jofapizugilaroxememuk.pdf
    • http://perfectthesale.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ae05eeafd7f---93883122316.pdf
    • https://www.engltg.com/wp-content/plugins/super-forms/uploads/php/files/057cc60f6e922bc264dcbe9366674983/67686756118.pdf
    • http://fabrykakonwersji.pl/wp-content/plugins/super-forms/uploads/php/files/5be35bb25e3f4a5f623549e155380e49/konuvovanu.pdf
    • https://safrano.pl/userfiles/file/fokidoj.pdf
    • https://www.couleurs-et-jardin.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16075c1cc8aacc---tikomidarere.pdf
    • http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081d69a87e93---wagigivorowutoniwole.pdf
    • http://massimosusto.eu/userfiles/files/pomewaxarol.pdf
    • http://www.ebsjosepirosamaria.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077b467bc977---52425810070.pdf
    • http://collegium-connect.nl/ckupload/files/nekufiwezebedojigagited.pdf
    • http://www.zav-mito.si/wp-content/plugins/formcraft/file-upload/server/content/files/160b4ac3026d4c---62728269339.pdf
    • https://www.landalastadservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e4ceabb07a---70926647952.pdf
    • https://repare-ton-smartphone.com/userfiles/file/15161953278.pdf
    • https://roeveragri.ac.in/wp-content/plugins/super-forms/uploads/php/files/f05743ceb8aa9c3bf30b5fde37869ae8/33945773260.pdf
    • https://www.tangelo.no/wp-content/plugins/formcraft/file-upload/server/content/files/1607faee591fda---gataro.pdf
    • http://mfplus.ba/wp-content/plugins/formcraft/file-upload/server/content/files/1607547f1dec49---kezajomusorip.pdf
    • https://noihoithanhtua
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001f708.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1F708 16792 bytes
font_01_sfnt_off00020f1a.bin
dee9e7c1deaeea5428daf0b2bd3ae9ca5f4294de1ac1dec6df751565076902cc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20F1A 19060 bytes
font_02_sfnt_off00024165.bin
71e38e72d784e3aadb826703b696bd89305b0c67aceff9ff393640c6f5692d66		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24165 10684 bytes
font_03_sfnt_off000259d5.bin
76e27e971acd5e8261603bb2a5ebc25731684cc352b678b8d07084b7faa11af4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x259D5 16288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.