Malicious PDF — malware analysis report

Static analysis result for SHA-256 7031848a766d86b8…

MALICIOUS

PDF

85.2 KB Created: 2021-06-28 16:18:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12
MD5: a4241c448eb24eaa3167f2e483958a3a SHA-1: 633c86f3454f1b32d8698b48a29254402f713b6c SHA-256: 7031848a766d86b8718b6b7600a64a25c8b873ee9657d39e8ced97dd7f85a996
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links pointing to compromised WordPress uploads and other disposable hosting, indicative of a link farm. The 'SE_PAYMENT_REDIRECT_LURE' heuristic strongly suggests the document's purpose is to trick users into believing there are changes to payment instructions, a common tactic in business email compromise attacks. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9860

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://scenekunstskolen-efteruddannelsen.dk/ckfinder/userfiles/files/39245565456.pdf In PDF document text
    • http://didopack.com/files/53778726626.pdfIn PDF document text
    • http://www.grupohk.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16093b09f2f645---42151103150.pdfIn PDF document text
    • http://www.bewegeninarnhem.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16079042f109b8---kevaj.pdfIn PDF document text
    • https://investmentskillsgroup.com/images/userfiles/file/61821151148.pdfIn PDF document text
    • https://readxyz.com/wp-content/plugins/super-forms/uploads/php/files/37e6dc9a8cd1adac7e96d0739bca2c0b/56534233337.pdfIn PDF document text
    • http://schmetterlingsgaerten.de/file/11307418479.pdfIn PDF document text
    • https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/shb9gocbopbkjp6jkk5chjo72n/ruzexetubuzi.pdfIn PDF document text
    • http://zoltysnieg.pl/pliki_wyswig/files/zurupolesawutamafezitojel.pdfIn PDF document text
    • http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b3db5385e9b---zoxewotaf.pdfIn PDF document text
    • http://pvsystexperts.com/wp-content/plugins/super-forms/uploads/php/files/aam918uhe5pp2fhgfvtfrc9cv7/kajumapekulakogodogew.pdfIn PDF document text
    • https://jamiatulbanat.in/wp-content/plugins/formcraft/file-upload/server/content/files/16089d2c364b17---17968033846.pdfIn PDF document text
    • http://accurateverdicts.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071cf51a3b9f---68939309835.pdfIn PDF document text
    • https://theemperorsoldclothes.co.uk/wp-content/plugins/super-forms/uploads/php/files/d6aml3u9tqrndpbaqmdfd17765/fogegigejajozowepoje.pdfIn PDF document text
    • https://www.modianodesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c86055d18d6---nowotivovipuvupaturivewo.pdfIn PDF document text
    • http://www.rkcomdesignservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160704d983e0c9---13331273052.pdfIn PDF document text
    • http://www.altrus.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160a90cc29824e---sejatixuzasinumapo.pdfIn PDF document text
    • http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606fd0b1743f8---85812921861.pdfIn PDF document text
    • https://www.helmmsp.ca/wp-content/plugins/super-forms/uploads/php/files/4b86986590fce47cbfd38f74689abdd3/71357698972.pdfIn PDF document text
    • http://graphicon.hu/wp-content/plugins/formcraft/file-upload/server/content/files/160768bbb0f655---77529230806.pdfIn PDF document text
    • http://dothi.info/images/files/30181837969.pdfIn PDF document text
    • https://www.teppiche-waschen-hamburg.de/wp-content/plugins/formcraft/file-upload/server/content/files/160bffe55822d0---7654084444.pdfIn PDF document text
    • http://www.pirac.org/wp-content/plugins/super-forms/uploads/php/files/688b3f818e751b945bf28ea36b61ddda/54674796620.pdfIn PDF document text
    • http://hataylezzeti.com/resimler/files/felusosizonewiwozasosulew.pdfIn PDF document text
    • https://www.rath-catering.de/wp-content/plugins/formcraft/file-upload/server/content/files/160b642fabdeff---68815979131.pdfIn PDF document text
    • http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c92cade1dbc---setegogefixad.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/1xuhb7AK25c/uplcv?utm_term=how+to+scan+from+ipad+to+emailPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9EC 10860 bytes
SHA-256: 327bd319379ce4289bac6c1bbd8e6dcfad2e7f908db8a8dc055e12d4ec7a5caa
font_01_sfnt_off00010307.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10307 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00011b19.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B19 16900 bytes
SHA-256: fa891f9d09dc86ce77140c921909ebf89b02ea93dabbc6223f687d8b24ea0cc9

Open this report in the interactive analyzer, or submit your own file for analysis.