Malicious PDF — malware analysis report

Static analysis result for SHA-256 78b898427d29a16f…

MALICIOUS

PDF

117.7 KB Created: 2021-07-08 01:49:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 016f9e61af917b5c50d5238b1db969f8 SHA-1: 7d8ab2a3be719948882f37c4c84faddd1865d0f9 SHA-256: 78b898427d29a16f18e0da45e3f12102030f5e55e27aceb146ba431c3e2dee59
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous links pointing to various websites, many of which are hosted on compromised WordPress installations or disposable domains, indicating a link farm or redirection scheme. The heuristic 'SE_INVOICE_LURE' suggests a potential phishing pretext. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for distributing further malware or conducting phishing attacks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9666

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://asbufestival.com/uploads/FCK_files/file/42000538796.pdf
    • https://ajwatravel.com/wheelmarine/userfiles/file/tulofubug.pdf
    • https://parokisantolukas.org/Uploads/userfiles/files/94331140386.pdf
    • http://nuyewpilot.academy/wp-content/plugins/super-forms/uploads/php/files/52397271c57e9b653ce7a5542fad3961/3162035271.pdf
    • https://www.blackandwhite-salon.com/wp-content/plugins/super-forms/uploads/php/files/8433ba5569030b06b3f8c00b73812191/rezuzonodoviwapiwukuwuxim.pdf
    • https://homeaestheticsllc.com/wp-content/plugins/super-forms/uploads/php/files/22c2cb0e195996dc089f0e1e5e73beb8/bekijirevogeguviwurajusul.pdf
    • https://law.com.sg/wp-content/plugins/super-forms/uploads/php/files/0747896162354f5d9d11ce51383c43e3/12255983204.pdf
    • http://www.argentum.com/wp-content/plugins/super-forms/uploads/php/files/f2hnn0j8t69409s5a741hhbf6s/46147060377.pdf
    • https://anukulagrotech.com/userfiles/file/lexamozo.pdf
    • http://hurtmar.pl/Upload/file/49387849841.pdf
    • http://ebbers-schilderwerken.nl/uploads/files/22636220638.pdf
    • https://www.grandeprairie.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a16ecd624f2---11836765482.pdf
    • http://www.hptindia.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a935ac379fb---kadizoberagimo.pdf
    • http://asbufestival.com/uploads/FCK_files/file/55084171712.pdf
    • https://www.grandeprairie.org/wp-content/plugins/formcraft/file-upload/server/content/files/160bacc989c828---janibavusiniwanunox.pdf
    • http://wamer.org/userfiles/file/wotominaguvidevawusu.pdf
    • https://sckprime.com/wp-content/plugins/super-forms/uploads/php/files/f8535c50a89a9a829c6d52a1d8fe9fdb/faxixuwinilexaku.pdf
    • https://bodwellassociates.com/wp-content/plugins/super-forms/uploads/php/files/151af4760ab64bdbebf86f45b3a0d390/87710268585.pdf
    • https://mavismanagement.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609458485003c---90907417996.pdf
    • http://www.hcibatiment.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16089dd7cea109---pibuvolebologopegav.pdf
    • http://nakatka.com/files/file/85623481824.pdf
    • https://ccveg.org/wp-content/plugins/super-forms/uploads/php/files/k21hvhdpah05ms4c0s5qrc7cec/87296111522.pdf
    • https://cashmeredreams.com/wp-content/plugins/super-forms/uploads/php/files/ba87c3f8f5248f6a2f1c428cf767490b/97963328359.pdf
    • https://qualitycountscleaning.com/wp-content/plugins/super-forms/uploads/php/files/004e0cc87aac8c382cacd0605e63115e/38176451634.pdf
    • https://www.uniqueartzz.com/wp-content/plugins/super-forms/uploads/php/files/r82gn26ft7qf5orm4hdkph4mgd/durisetiforuvu.pdf
    • http://ankarapianofestival.com/userfiles/file/41535065644.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/cv9VXjIrmdE/uplcv?utm_term=explain+distributive+property+with+example
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014b26.bin
5f00a62ad98c408afaf8b2062f162a1bf31050a3e2f6201d18a37477ab6e79d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14B26 19724 bytes
font_01_sfnt_off00017f9b.bin
35973b3949a2f4986c25b341772962e1fb52ceca76192f5937a81f239dd8c184		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17F9B 11248 bytes
font_02_sfnt_off000199a4.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x199A4 16792 bytes
font_03_sfnt_off0001b1b5.bin
5be2378ee9fe57a5dd842e30442b5d3e40d380a746c419b60e3f5f8b52658b83		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B1B5 16652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.