Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ac181f79c8237d4…

MALICIOUS

PDF

102.0 KB Created: 2021-06-26 09:52:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25
MD5: 7c4567d1e0f6389c6c4a7518ef306a68 SHA-1: 900f1b361e3e3549ab4fb95ed863faacc3c8225e SHA-256: 7ac181f79c8237d4e5bc24e21128fbc09fa7984eb5f2bda49e68ddd37d30a304
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains numerous links pointing to websites that appear to be compromised CMS uploads, suggesting a phishing or malware distribution lure. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were extracted, the structure and embedded URLs point towards a phishing attack that likely aims to trick users into downloading further malicious content or visiting malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9888

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sarahscupcakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089f6f8eaa46---zonaxozexofevaxil.pdf In PDF document text
    • https://www.cpro.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1607edd4d3854b---dofoxovikazemiruton.pdfIn PDF document text
    • http://bulk-supplies.com/userfiles/file/80449109648.pdfIn PDF document text
    • http://www.kzhep.in.ua/wp-content/plugins/super-forms/uploads/php/files/cgftiltms8t4upjiu93gqlsgi4/3902558096.pdfIn PDF document text
    • http://thepokeluau.com/uploads/files/72004645893.pdfIn PDF document text
    • http://joshuadacosta.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071e05971b55---9333260091.pdfIn PDF document text
    • https://jetzterstrecht.hamburg/wp-content/plugins/super-forms/uploads/php/files/3oki6k05dbjp9pgl803q6025e1/defelezil.pdfIn PDF document text
    • http://2016montemayorreunion.com/clients/e/e5/e530e98a7ee505477716bae2fe71cdef/File/zurixaj.pdfIn PDF document text
    • http://agcslohian.com/userfiles/file/kixemafidegesubuzixaxo.pdfIn PDF document text
    • http://carmakers.cz/userfiles/files/jozij.pdfIn PDF document text
    • https://ceadersvalet.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c90bc97dd3---namunufige.pdfIn PDF document text
    • https://seataclightingalaska.com/wp-content/plugins/super-forms/uploads/php/files/12c8986603711930267d56bce0fea63f/4364007559.pdfIn PDF document text
    • http://www.marsagri.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608456bb05707---nazolewovozida.pdfIn PDF document text
    • http://dodici12.ru/wp-content/plugins/super-forms/uploads/php/files/km30rs8fd5m790pnf5fd3seqi6/kasinepodepas.pdfIn PDF document text
    • http://niszczeniewaw.pl/userfiles/file/vibotavakevogefukuxaz.pdfIn PDF document text
    • https://eclipsetheaters.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb514e8bcbd---75007277782.pdfIn PDF document text
    • https://agentcctv.com/userfiles/file/jovavukapus.pdfIn PDF document text
    • http://festivaldeliteraturadepereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/16092dc8577393---33014599594.pdfIn PDF document text
    • https://werbemittelag.chupload/file/98342573334.pdfIn PDF document text
    • http://foire-fromages-et-vins.com/wp-content/plugins/formcraft/file-upload/server/content/files/160802bc6b399e---59847920013.pdfIn PDF document text
    • https://dovolena-jiznicechy.cz/uploads/29485114603.pdfIn PDF document text
    • https://www.kiteschule-kiel.de/wp-content/plugins/formcraft/file-upload/server/content/files/16083c6ef9bbe8---8475946349.pdfIn PDF document text
    • https://www.temsilcisitesi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608d08ba216b4---71007455139.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/A3Ryygt5BCM/uplcv?utm_term=india+map+with+directions+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011d86.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D86 10876 bytes
SHA-256: 969c69217338e85f6e3d0651d78eb0a1e6f2f0a1456ccc3b0d7457f93331dd0f
font_01_sfnt_off0001367b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1367B 19448 bytes
SHA-256: 7f57179280d84c961398646fa2a49a720002f254815c47eacd4b5a1ee338f81f
font_02_sfnt_off00016765.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16765 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off00017f72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17F72 2128 bytes
SHA-256: e3b371c0947b9e6c2891f87b7f66448edd63db95b70e07e69f8e4b383bbc8e91

Open this report in the interactive analyzer, or submit your own file for analysis.