Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ce95a1363b29c95…

MALICIOUS

PDF

78.2 KB Created: 2021-06-30 05:22:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25
MD5: e6d1696e2c97f2f8a0f430bb013cbc5c SHA-1: ebfc11e6e07c40ab17f91ff61760533bf1a0bd5c SHA-256: 7ce95a1363b29c955a8c5537e88c1e2bd2ee3ac9853807ffd13d748b81426c2b
256 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript that appears to be related to metadata, but the overall structure and numerous links to compromised WordPress sites suggest a phishing or redirection attempt. The document body and script metadata reference 'Windows powershell 3.0 step by step', likely a lure to disguise the malicious intent. The presence of multiple links to compromised CMS uploads indicates a pattern of hosting malicious files on potentially vulnerable websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9846

Heuristics 9

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.digitalsofts.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609ed506bcfa9---12897221193.pdf In PDF document text
    • http://themultifold.com/wp-content/plugins/super-forms/uploads/php/files/44lkrs35jqusbvn4b7n3qh22m7/67434593806.pdfIn PDF document text
    • http://english-life.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1607270f6a640a---jetamozutozefevezekim.pdfIn PDF document text
    • https://afd.me.uk/wp-content/plugins/super-forms/uploads/php/files/2f5rm0o32it3tu4b2r4kbe9bbh/xuwiv.pdfIn PDF document text
    • https://okazdedziecko.pl/_files/Media/file/julusepepetazewe.pdfIn PDF document text
    • http://donaldnathanlaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/bisifizo.pdfIn PDF document text
    • http://www.hotel-margherita.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ba223757750---82208657312.pdfIn PDF document text
    • https://www.yoursurveysurveyors.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160a7853e20cf2---xezatelovexibidike.pdfIn PDF document text
    • http://lighthouseofworship.com/clients/44803/File/vaduximuzewofejuginasaziz.pdfIn PDF document text
    • http://www.empresasdelimpeza.info/wp-content/plugins/formcraft/file-upload/server/content/files/16079f77aa211e---roposijonitibevinodep.pdfIn PDF document text
    • https://publicbridge.pl/userfiles/file/71375610556.pdfIn PDF document text
    • https://kayakbranson.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b523daf32e---43442935315.pdfIn PDF document text
    • http://leap-egypt.com/wp-content/plugins/formcraft/file-upload/server/content/files/16076e400d3781---fofuzupikom.pdfIn PDF document text
    • http://host.keraladreamhomes.com/~viswabrahmathach/admin/fckeditor/editor/filemanager/connectors/php/userfiles/file/31595526528.pdfIn PDF document text
    • http://paillasse.hu/userfiles/file/duwolarego.pdfIn PDF document text
    • http://www.playerclub.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160c0723119440---jazusokakafis.pdfIn PDF document text
    • http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/160bf23667b72b---5780240220.pdfIn PDF document text
    • https://kicksomeglass.com/wp-content/plugins/super-forms/uploads/php/files/367e4924ae01d4a7a0641a5a11b02ee4/zuwibinumida.pdfIn PDF document text
    • https://www.vbclighting.com/wp-content/plugins/super-forms/uploads/php/files/714df6778b08e8788eae39645dda02f4/xabet.pdfIn PDF document text
    • https://laxmigrouppune.com/wp-content/plugins/super-forms/uploads/php/files/f98f751c2133881b5551a47427b7b6dc/pizuwusixedilafafidumaj.pdfIn PDF document text
    • https://ehblending.com/wp-content/plugins/super-forms/uploads/php/files/86c4845fbab2ea7336dfa10aa0083561/51214272459.pdfIn PDF document text
    • http://www.icodar.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075065c87da6---bifukeposasozuwo.pdfIn PDF document text
    • https://www.corridar.com/wp-content/plugins/super-forms/uploads/php/files/533fcl4a1139ebg3eo40q3tu8a/65110363457.pdfIn PDF document text
    • https://marlin-aquarium.ru/ckfinder/userfiles/files/tegalu.pdfIn PDF document text
    • https://weinquartier.at/wp-content/plugins/super-forms/uploads/php/files/b75773fb5c7c294b9ce5e03f0cf63804/xisuxamipexifubutapadupa.pdfIn PDF document text
    • http://www.photobreak.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160aa5fb74fe06---9551690581.pdfIn PDF document text
    • https://www.digitalsofts.com/wp-In macro / runtime command snippet
    • https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=windows+powershell+3.0+step+by+stepPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_00013397.bin pdf-embedded-script PDF raw stream script payload at offset 0x13397 1588 bytes
SHA-256: 40bc42d6f1012e9f6d8c15c859895570a41753bf66128f85855c0340476f1b97
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 shell/COM execution token(s).
Preview script
First 1,000 lines of the extracted script
<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?>
<x:xmpmeta xmlns:x='adobe:ns:meta/' x:xmptk='GIMP'>
<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>

 <rdf:Description rdf:about=''
  xmlns:dc='http://purl.org/dc/elements/1.1/'
  dc:format='application/pdf'>
  <dc:creator>
   <rdf:Seq>
    <rdf:li>Sakifomu Yinoce</rdf:li>
   </rdf:Seq>
  </dc:creator>
  <dc:description>
   <rdf:Alt>
    <rdf:li xml:lang='x-default'>Windows powershell 3.0 step by step.  How To Install PowerShell PowerShell is a task automation engine from Microsoft with a command-line</rdf:li>
   </rdf:Alt>
  </dc:description>
  <dc:subject>
   <rdf:Bag>
    <rdf:li>Windows powershell 3.0 step by step.  How To Install PowerShell PowerShell is a task automation engine from Microsoft with a command-line</rdf:li>
   </rdf:Bag>
  </dc:subject>
  <dc:title>
   <rdf:Alt>
    <rdf:li xml:lang='x-default'>Windows powershell 3.0 step by step</rdf:li>
   </rdf:Alt>
  </dc:title>
 </rdf:Description>

 <rdf:Description rdf:about=''
  xmlns:pdf='http://ns.adobe.com/pdf/1.3/'
  pdf:Producer='GIMP'/>

 <rdf:Description rdf:about=''
  xmlns:xmp='http://ns.adobe.com/xap/1.0/'
  xmp:CreateDate='2020-03-10T09:51:34'
  xmp:CreatorTool='GIMP'/>

 <rdf:Description rdf:about=''
  xmlns:xmpMM='http://ns.adobe.com/xap/1.0/mm/'
  xmpMM:DocumentID='98b42389-4d7e-4696-bbb8-b3aa8aa21a88'
  xmpMM:InstanceID='44ee65e1-7bde-4de5-ae30-016df3ddde59'/>

 <rdf:Description rdf:about=''
  xmlns:xmpRights='http://ns.adobe.com/xap/1.0/rights/'
  xmpRights:Marked='True'/>
</rdf:RDF>
</x:xmpmeta>
<?xpacket end='w'?>
font_00_sfnt_off0000cf71.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCF71 11020 bytes
SHA-256: 666ac9a5da15934cb1da2545e3f24ac8f6c60c46b4b1ff16024c733f01abeed5
font_01_sfnt_off0000e8d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8D2 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000100e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100E4 16400 bytes
SHA-256: e8b89fb6157a36e7f4c08ecef0c280e21e57c34da3d42bc1dded0cb852ccf054

Open this report in the interactive analyzer, or submit your own file for analysis.