Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e8fb6e1bc45ea1c…

MALICIOUS

PDF

198.2 KB Created: 2021-07-02 19:48:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 3c494aff223a89f05250ceefa7b2e349 SHA-1: d86e49161dd10f7d52e8bb925b0f747271bbd652 SHA-256: 7e8fb6e1bc45ea1c52e8d19b4bcbf85ad6aa59ee4c8a8b5db1385724f1ae68f4
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF was detected as malicious by ClamAV and an ML classifier, exhibiting characteristics of an advance-fee scam. It contains multiple external URIs, including one pointing to a raw IP address and others hosted on compromised WordPress sites, suggesting an attempt to deliver a malicious payload or phish for credentials. The document's structure and embedded links indicate a lure for a lottery, prize, or parcel delivery scam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9741

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/uplcv?utm_term=public+finance+and+public+policy+gruber+pdf+free PDF link annotation
    • http://payassistinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c987eeea86---3069569393.pdfIn PDF document text
    • http://easyreturn.store/userfiles/file/46386367822.pdfIn PDF document text
    • https://www.nobleorthodontic.com/wp-content/plugins/super-forms/uploads/php/files/8885389992fa8bfab9e2c53f3f839b5c/5528242640.pdfIn PDF document text
    • https://adbetelparaguay.com/wp-content/plugins/super-forms/uploads/php/files/b6313cf3f7149dbb466d4c3bc868d0d1/kazudobumivipel.pdfIn PDF document text
    • http://sts-logistika.ru/wp-content/plugins/super-forms/uploads/php/files/72cd6ff284fc158089dd5d76ab59fa47/wofumojokajar.pdfIn PDF document text
    • http://yishiweb.com/upfiles/files/20210616_224632.pdfIn PDF document text
    • https://suksesunited.com/contents//files/5608588777.pdfIn PDF document text
    • https://oiweld.com/wp-content/plugins/super-forms/uploads/php/files/3a04daa4d108cf6b63cd6a5679d053bf/xasuvaligarawepugufikibe.pdfIn PDF document text
    • http://skpizzasubs.com/uploads/files/riwutikepabezogug.pdfIn PDF document text
    • https://www.truesdalepainting.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087f79bde879---towovezop.pdfIn PDF document text
    • http://www.tif.cn/wp-content/plugins/super-forms/uploads/php/files/mvrmah3hvc17do11ternf9demp/55604782587.pdfIn PDF document text
    • http://www.bash.cl/media/file/15459823781.pdfIn PDF document text
    • https://kund-in.com/userfiles/file/7074983006.pdfIn PDF document text
    • http://dioceseofniranam.org/userfiles/file/ravusubizu.pdfIn PDF document text
    • https://christianboudreau.com/wp-content/plugins/formcraft/file-upload/server/content/files/160705064aaa44---13689738582.pdfIn PDF document text
    • https://tskrea.com/userfiles/file/xabulidatogerik.pdfIn PDF document text
    • http://baaningdoi.com/file_media/file_image/file/warit.pdfIn PDF document text
    • http://ljhalls.com/wp-content/plugins/super-forms/uploads/php/files/32886239ae6e2e5e5b059a25472b5f74/gapuke.pdfIn PDF document text
    • https://amitadevnani.com/userfiles/file/towejudiwuzogo.pdfIn PDF document text
    • http://drive4smilesquebec.com/clients/f/f5/f58105ca183540932673f5bf18e62671/File/96244524660.pdfIn PDF document text
    • http://157.230.241.115/image/upload/File/74779294678.pdfPDF link annotation
    • http://fulepmark.hu/nyebu/fulepmark/userfiles/file/zenuxigokuzasememedek.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00029058.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x29058 10884 bytes
SHA-256: 4557ed101632c9c1650d4259f47fb96e24f743de2ac22c760a885695c13be954
font_01_sfnt_off0002a922.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A922 16084 bytes
SHA-256: a79c9caf7d9fe7d7e6557dd08284a48a0650ee9668136fadcfdab94fba17ddb2
font_02_sfnt_off0002be56.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BE56 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off0002d668.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D668 18852 bytes
SHA-256: 50338947d54f1fb402d3ec11becb9920551edcf188e8b6579f8d0259d0345a69

Open this report in the interactive analyzer, or submit your own file for analysis.