Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ef19b2b316fc7ea…

MALICIOUS

PDF

131.5 KB Created: 2021-09-01 20:12:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05
MD5: 38eabc3ff604dafd96c0cc558282c4f3 SHA-1: 0665b58f7ba1db4805af8ebe109fbcfb7662448c SHA-256: 4ef19b2b316fc7eaa79728a9849d7e1ea64b7c0cec25b73f42e5e90c28867b05
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by a machine learning classifier and ClamAV, indicating a phishing or trojan threat. The document exhibits characteristics of a callback phishing lure, prompting users to contact a provided phone number for issues like billing or refunds. While no scripts were directly extracted, the PDF structure and associated URLs suggest it is part of a larger phishing infrastructure designed to exploit user trust.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9978

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://yamamatoen-wanwan.jp/ckfinder/userfiles/files/kiwotufite.pdf In PDF document text
    • http://e-district.org/userfiles/file/36981098325.pdfIn PDF document text
    • https://advancedcheckcashadvance.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b681f9d4abb---nagijegilet.pdfIn PDF document text
    • http://naplesredeals.com/userfiles/files/muxepina.pdfIn PDF document text
    • https://postelezmasivu-liberec.cz/ckfinder/userfiles/files/80748256783.pdfIn PDF document text
    • https://livingcircles.ch/wp-content/plugins/formcraft/file-upload/server/content/files/160903d7021c24---balewaxisunineboda.pdfIn PDF document text
    • https://pk-kuepfer.ch/ckfinder/userfiles/files/35111582915.pdfIn PDF document text
    • http://www.naturapreserved.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a4cc7b6034f---52808909578.pdfIn PDF document text
    • http://bsl-trans.ru/admin/ckfinder/userfiles/files/xuzetalolaxatugifawim.pdfIn PDF document text
    • https://moma-restaurant.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ee717589b3b---modedumisituserime.pdfIn PDF document text
    • http://tincorner.vn/uploads/files/88885080825.pdfIn PDF document text
    • http://alnoorcity.com/userfiles/file/gujinoro.pdfIn PDF document text
    • https://madspot.dk/ckfinder/userfiles/files/zegogogejufuwuvit.pdfIn PDF document text
    • https://jollytime.ru/wp-content/plugins/super-forms/uploads/php/files/6126dfd8e911d2bb9d2ff0d06a1a088e/nesukevolijujuxobebupili.pdfIn PDF document text
    • https://fizjolech.pl/userfiles/file/soxuwiwusasos.pdfIn PDF document text
    • https://soudureornementalelauziere.com/upload/editor/file/radavire.pdfIn PDF document text
    • https://stellabakingcompany.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cca8267b0e---xuxupuwabupusanipixe.pdfIn PDF document text
    • https://birsamundapark.in/userfiles/files/wazegogavijudikemizisotud.pdfIn PDF document text
    • https://ventana-sur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608d608e5e7e3.pdfIn PDF document text
    • http://orthopaede4you.de/userfiles/file/71970383357.pdfIn PDF document text
    • http://activesolutionelectric.com/images/file/3946840810.pdfIn PDF document text
    • https://webmodeli.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ff33ced5302---kavikiratixowogeti.pdfIn PDF document text
    • https://www.theknowledgeonline.com/files/lib/ckfinder/userfiles/files/dufaboso.pdfIn PDF document text
    • http://xn----8sbpvg0afdbe.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/378d7mlcf5b804er4h3tjuil51/fixoxarogumowufixikikaka.pdfIn PDF document text
    • http://kietminhrivet.com/upload/files/30605708864.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/3vuEKuznOb8/uplcv?utm_term=properties+of+water+quiz+answersPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000198d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x198D1 21008 bytes
SHA-256: 5c84f8b1234b466cdd2adc2b384114eb9a4c952e29a7954a6bfba8834815be07
font_01_sfnt_off0001ced9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CED9 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0001e6f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E6F0 10696 bytes
SHA-256: dbde57bdd42eae76a959e2561f6420d9d319db344f5241062c74575107d249d7

Open this report in the interactive analyzer, or submit your own file for analysis.