Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ae7fc7d73cd8603…

MALICIOUS

PDF

72.2 KB Created: 2021-05-24 13:06:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 146d78d8ee00ff58e61e1ebe0758cd7e SHA-1: 8e82e1122b5ee3a7849b2f5e0e8a110393fc0b54 SHA-256: 7ae7fc7d73cd8603b15121db6e5724a634bf1f03fa44c62926d4d8218eb42acf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ML classifier and ClamAV detection strongly indicate maliciousness. The embedded URLs, particularly those pointing to file uploads within common CMS plugins, suggest a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains metadata related to PDF creation and a construction project scheduling topic, likely serving as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://topopentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c686572cdb---marin.pdf
    • http://victorylimo1.com/wp-content/plugins/formcraft/file-upload/server/content/files/160982a5b408d1---nefabuwisoxadi.pdf
    • https://www.acetechnology.co.in/wp-content/plugins/super-forms/uploads/php/files/pdued33u6r1p83bljgp8oltb84/53640188246.pdf
    • https://www.limratechnologies.net/wp-content/plugins/formcraft/file-upload/server/content/files/16089d92bc1b89---pulixuxunexenu.pdf
    • https://www.ideaklinikbakirkoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b569eabd39---kosurigasusiraman.pdf
    • http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a4d4079673---11487244165.pdf
    • http://www.hotel-margherita.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081ddf3939ce---5973779170.pdf
    • https://canadianrelocation.net/wp-content/plugins/formcraft/file-upload/server/content/files/16084ff3423524---taxilunomodibadokegujep.pdf
    • https://www.nestroots.com/wp-content/plugins/super-forms/uploads/php/files/59tvgaj52e7tk6fr1aoiqvj0e6/kasure.pdf
    • https://vmkstroi.ru/wp-content/plugins/super-forms/uploads/php/files/739c96533b41b4bb2b7e3e4907d6bd75/suruwomirus.pdf
    • https://pluviaterra.mx/wp-content/plugins/super-forms/uploads/php/files/70c05f48d98a665300909fd67177f21c/vanevijotepotutomarojawo.pdf
    • http://acetuitioncentre.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607bbb8502bc7---gexigigasejuxato.pdf
    • http://a-swiss.com/upload/userfiles/file/ruvelebup.pdf
    • http://dangkyidol.com/wp-content/plugins/super-forms/uploads/php/files/e2u3oi3938e74mo7663plp6fab/siwufitepa.pdf
    • http://israel-aliya.com/wp-content/plugins/super-forms/uploads/php/files/6374ef6c478d0fc4d8b9d0f86088cf10/xiwexiruz.pdf
    • http://timatey.kz/wp-content/plugins/super-forms/uploads/php/files/lci9agqs78dc8dfe3ha96tl753/92679248841.pdf
    • http://eurogeographyjournal.eu/admin/fckfiles/file/23409977816.pdf
    • http://alternativefitness.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160773a3004255---sinubajuzunonuvibuw.pdf
    • https://allcreaturesinc.com/files/files/vusojarazebox.pdf
    • https://fmpride.com/wp-content/plugins/super-forms/uploads/php/files/7ab54ca545194cfbf33abf2e631cb762/75104477693.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/skout/mBVl/~3/6naE_Nh8_CY/uplcv?utm_term=construction+project+scheduling+and+control+4th+edition+pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db59.bin
163b165c820e54c9f82cc96b1011054ef480660f95964e5aff10bb4ecb8bd94c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB59 5484 bytes
font_01_sfnt_off0000ee06.bin
f0d76277e5838fb61780639924de936b950972a03b7993b9b437e35a6f2bd2d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE06 10744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.