Malicious PDF — malware analysis report

Static analysis result for SHA-256 46e9ef8891075c9b…

MALICIOUS

PDF

83.6 KB Created: 2021-08-12 08:36:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-24
MD5: 7b44cf61f761ec9aa096a97fb980eafe SHA-1: 156e773339bccddb4dcef850541a4d83341b22c0 SHA-256: 46e9ef8891075c9b92febecce40098aad42fae2ae0bf6cf22e8e3bae71e3dcd3
224 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document that exhibits characteristics of a phishing lure, specifically requesting sensitive recovery information. It contains numerous links to external resources, many of which point to compromised WordPress upload directories or disposable hosting, suggesting a distribution network for malicious content. The ClamAV detection and the 'SE_SECRET_RECOVERY_LURE' heuristic strongly indicate a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.0181

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=crt+screen+off+animation+apk+roots PDF link annotation
    • http://aerotechgroup.ru/img/outer/files/mumamaxutovem.pdfIn PDF document text
    • http://www.santamyoga.be/images/file/53119882613.pdfIn PDF document text
    • https://q-web.ro/wp-content/plugins/super-forms/uploads/php/files/f2djtdgvd15d2ivqq2kdikgjd6/32859682132.pdfIn PDF document text
    • http://stroynerud-sm.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160f6fad1f2364---39144501060.pdfIn PDF document text
    • http://gistfamilyreunion.com/clients/8/8c/8cbf0a40baaab9dd4734ff2cdbb1e120/File/43158358009.pdfIn PDF document text
    • http://studiolorenzino.eu/userfiles/files/joselelafapetejeger.pdfIn PDF document text
    • http://mirembeestate.co.ug/wp-content/plugins/formcraft/file-upload/server/content/files/16096656918629---roxuvovoratufexabasoxax.pdfIn PDF document text
    • http://1984wnhs.com/clients/2/25/250e0aaa51dad033202e6c34d8602b4d/File/84085456627.pdfIn PDF document text
    • http://www.bestlifepolicy.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160fd79e34499a---79643218092.pdfIn PDF document text
    • http://bulk-supplies.com/userfiles/file/6110014549.pdfIn PDF document text
    • http://goodwill.pl/userfiles/file/93099403883.pdfIn PDF document text
    • http://makingtheturngolf.com/clients/9/92/925d9bae4ecf380f28dbe0e1390c16eb/File/dineledesekadojo.pdfIn PDF document text
    • http://przychodnia-felinskiego.pl/uploads/editor/file/71947792577.pdfIn PDF document text
    • http://gps-ambroisie.com/ressource/site-image/files/48662431923.pdfIn PDF document text
    • http://trainternational.in/wp-content/plugins/formcraft/file-upload/server/content/files/1608b3d77c5d30---14747380390.pdfIn PDF document text
    • http://beckydavidsonhomes.com/wp-content/plugins/formcraft/file-upload/server/content/files/160982d6954920---37155296470.pdfIn PDF document text
    • https://rhdplumbing.com/wp-content/plugins/super-forms/uploads/php/files/c84f67b025f3e673a912fbf9cea30590/34781276208.pdfIn PDF document text
    • http://www.advokat.com/app/webroot/img/fck/file/wuxiwasilunu.pdfIn PDF document text
    • https://futuresbuilder.net/dayafter/uploadimages/newsimages/file/6784362344.pdfIn PDF document text
    • http://thietbiotovn.com/Images_upload/files/wipofe.pdfIn PDF document text
    • http://zawayakw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090879bd0fa5---liduromosebipodazasoxavom.pdfIn PDF document text
    • https://cantellodetersiviprofessionali.it/uploads/file/zebulidajulopopakotiwafez.pdfIn PDF document text
    • https://carstenrath.com/wp-content/plugins/super-forms/uploads/php/files/jrqpue65mt262phgtdeeobtilc/jofowimunero.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebc2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBC2 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off000103d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103D9 10720 bytes
SHA-256: 4f331051bb4fbe8dc565ed0cf441ff6cc5cd7a5ee0d8028e45f6da8334e8cb1d
font_02_sfnt_off00011c85.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C85 17200 bytes
SHA-256: cfe8f407290d9a7adc3684f0dd436481c62f2dbe70c2605d44e00d075b9a127c

Open this report in the interactive analyzer, or submit your own file for analysis.