Malicious PDF — malware analysis report

Static analysis result for SHA-256 813668fac3bc83f9…

MALICIOUS

PDF

85.6 KB Created: 2021-07-07 08:23:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 916d995c036e38303a8176952cd98cf2 SHA-1: 14b2a4c88e350da7acbe81022ac239cbedeb9893 SHA-256: 813668fac3bc83f9f7acd57bc90ce0ebf97540c6a9c9454bec8d8528d7e12a95
204 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and multiple external links, many of which point to compromised WordPress sites. The 'SE_MFA_LURE' heuristic indicates the document is designed to harvest credentials or MFA codes. The embedded JavaScript likely facilitates the redirection to malicious URLs, contributing to the overall phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 8

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://timatey.kz/wp-content/plugins/super-forms/uploads/php/files/3uus107ss1mss0jisag0duss61/divakoxoxeponex.pdf In PDF document text
    • http://maility.pl_adresuserfiles/file/17064701734.pdfIn PDF document text
    • http://manufim.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/16072ca52e0201---jiresinigarapulirijoxud.pdfIn PDF document text
    • http://www.saraviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075b22d30938---6283777411.pdfIn PDF document text
    • http://baanpowertrain.com/wp-content/plugins/formcraft/file-upload/server/content/files/16092e1b57db44---pumefokusokigepizi.pdfIn PDF document text
    • https://www.hdontheroadnapoli.it/wp-content/plugins/formcraft/file-upload/server/content/files/1608d5314e3e70---28230712183.pdfIn PDF document text
    • http://queuemanagementsystems.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c89661acc2a---butekuleruduredukewibezow.pdfIn PDF document text
    • http://www.sensible-seeds-premium.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e19836b47b4---gazozi.pdfIn PDF document text
    • https://growlocals.com/wp-content/plugins/super-forms/uploads/php/files/e56a57d1ffea94fe825db639eba9f199/20349306281.pdfIn PDF document text
    • http://www.alrafeef.com/faisaliya/js/ckfinder/userfiles/files/21320829684.pdfIn PDF document text
    • https://meesens.be/KrMee/Tekstverwerker/63238709229.pdfIn PDF document text
    • http://titusrelay.com/clients/e/ef/ef304ccc03541e9e6382bef5f13b0a7d/File/tevikufivesuwarakekek.pdfIn PDF document text
    • http://bienbao.net/uploads/files/gukokex.pdfIn PDF document text
    • https://avantkart.com/wp-content/plugins/super-forms/uploads/php/files/8qderl88o4mekhutrrrrjdqs6p/97328618683.pdfIn PDF document text
    • http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f8ebe1539d---95921558838.pdfIn PDF document text
    • https://www.saltriot.com/wp-content/plugins/super-forms/uploads/php/files/73334b485761b87887a88c344dc6e880/83646498467.pdfIn PDF document text
    • https://htfcompact.com/wp-content/plugins/super-forms/uploads/php/files/861e6aa9a5288860c54b768ad3947dc7/rulowemazilimevajav.pdfIn PDF document text
    • http://mouaumfb.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608000557264d---vetofomekox.pdfIn PDF document text
    • https://refour.dk/wp-content/plugins/super-forms/uploads/php/files/a115682cacb0adbeeb7736bf207e1037/6845963785.pdfIn PDF document text
    • http://pansophers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160856f608fa3c---pobebu.pdfIn PDF document text
    • http://ophirtonhotel.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607ae43a04638---vekogawozerewododipokarot.pdfIn PDF document text
    • https://torrentclub.vip/wp-content/plugins/super-forms/uploads/php/files/e8vcdgsrmlhpi0b6hl7638jhnu/xowegedigaligu.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/PmAiG5ZyT-k/uplcv?utm_term=let+me+confirm+and+get+back+to+youPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA0E 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00010220.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10220 16860 bytes
SHA-256: be0906831c76446919d95fff740afc91fd5b78122a60cd9ddea3913315d8024f
font_02_sfnt_off00012e26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12E26 11008 bytes
SHA-256: 54fccebd0264e5ab9d6635bbafe43a93aa8f5e89af3fa10e663b4cb40b3f02fd

Open this report in the interactive analyzer, or submit your own file for analysis.