Malicious PDF — malware analysis report

Static analysis result for SHA-256 532d8cb2e9a829b5…

MALICIOUS

PDF

318.3 KB Created: 2021-06-25 22:04:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 8b40b49cbf68d52338a917f84efd8f00 SHA-1: 5bd2857a0d2548eeeaff63318b405d563d62f3b4 SHA-256: 532d8cb2e9a829b587109fec67bcab4e1b4d769d91db874b05357dfa90474de7
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document exhibits characteristics of an advance-fee scam, presenting a lure related to a prize or parcel delivery and instructing the user to call a phone number. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were extracted, the document's structure and embedded URLs point towards a phishing or scam operation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9046

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rszm88.com/upfolder/e/files/20210530030344.pdf
    • http://rusiuojigalvoji.lt/wp-content/plugins/formcraft/file-upload/server/content/files/16082e074e70f5---vejufujogewigamitevijefuz.pdf
    • https://www.etbsupplies.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073b4d168efe---tufezuzubebupuda.pdf
    • http://www.aluvascientific.com/UserFiles/file/29956789012.pdf
    • http://www.phonefixcomo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cacbf67f88---75811576554.pdf
    • http://rajskiewakacje.pl/userfiles/file/jutipezowanejozosimefew.pdf
    • https://adepotcustom.com/UploadFiles/file/20210516034901153.pdf
    • http://www.alfainstal.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16096143969aba---21008982462.pdf
    • http://begemot-rus.com/uploadfiles/file/2021051920081073499.pdf
    • https://goactive.hu/wp-content/plugins/super-forms/uploads/php/files/658b4109bc9249448cc5af7abd1a0a30/28052975071.pdf
    • http://sooclose.eu/upload/File/xezolugariv.pdf
    • http://www.christinemartin.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1608e698268da8---xotidilixokozew.pdf
    • https://www.carlosfunes.es/wp-content/plugins/formcraft/file-upload/server/content/files/1607bb4833ffb9---mobizunepetunigukewegim.pdf
    • http://xn--eyt274i.com/upload/files/xamevo.pdf
    • https://www.revistadefiesta.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ae792a499c4---xubivagemameledex.pdf
    • https://refour.dk/wp-content/plugins/super-forms/uploads/php/files/8413638bfc593bc4dfdc0ca74b5d6bb7/85208048309.pdf
    • https://refour.eu/wp-content/plugins/super-forms/uploads/php/files/22c29944b64151f3dec36a5db8f5d2e1/18871625060.pdf
    • https://studiogreenwich.ru/wp-content/plugins/super-forms/uploads/php/files/56442dc9ef98f8a527911ce55a7a525d/detovijivuja.pdf
    • http://clinicacomciencia.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a3888c62154---mizizukamisesasu.pdf
    • https://agrotehholding.ru/wp-content/plugins/super-forms/uploads/php/files/2bdb41d4a02c76380919a6222a1d67fa/61026628244.pdf
    • https://sirikulsteel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b786678d76d---marezal.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=five+nights+at+freddys+unblocked
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000432bf.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x432BF 16792 bytes
font_01_sfnt_off00044ad6.bin
01962e5c238a14011cd100518570291f8060e32f349b6ca2dcec2734e461e837		 pdf-font-stream PDF embedded font (sfnt) at offset 0x44AD6 11244 bytes
font_02_sfnt_off000464ea.bin
67315844e2c07a6bd10da455fa51a855186c926d4dca7b27037c56ef5f9585e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x464EA 9816 bytes
font_03_sfnt_off000484d3.bin
fdafae0fc4ec69cdacb618c8cd4163276036b69cb42a0c56f5649c00422e7377		 pdf-font-stream PDF embedded font (sfnt) at offset 0x484D3 28660 bytes
font_04_sfnt_off0004cb38.bin
7ca0c74e3aff4a882da201f2971533d666eb520f5d037a95f7a9a1fb27463d09		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4CB38 18872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.