Malicious PDF — malware analysis report

Static analysis result for SHA-256 8300f3e1d2f2bd10…

MALICIOUS

PDF

86.8 KB Created: 2021-07-06 13:47:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: e69db96df712e9463684b2ff43d8824b SHA-1: 319539a0dcc20cde12724627839bb537960dd301 SHA-256: 8300f3e1d2f2bd10aa4c34c00f78ad9ef1ba8c7ddfc0f0f9f7d25ac4c6c01dae
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics, including a high-confidence ML classifier and ClamAV detection, indicating malicious intent. The 'SE_BROWSER_INSTALL_LURE' heuristic suggests the document's content is designed to trick the user into installing a browser extension or update. While no scripts were directly extracted, the presence of numerous URLs, many hosted on compromised CMS upload directories or disposable hosting, points to a phishing or malware distribution scheme. The document's structure and the nature of the URLs suggest it is part of a phishing campaign aiming to deliver a second-stage payload or steal credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cuanhuaabshanquoc.vn/files/vovutuzuno.pdf In PDF document text
    • https://annjulieskarpmo.com/userfiles/file/7523792237.pdfIn PDF document text
    • https://www.jahnigterbraak.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1609215a1c2a91---32515220628.pdfIn PDF document text
    • https://wamsconference.com/wp-content/plugins/super-forms/uploads/php/files/c91570220a54e5fb2b87c18f6fcd6352/97653590691.pdfIn PDF document text
    • https://www.aironface.com/wp-content/plugins/super-forms/uploads/php/files/794164513e1d812a9500a7a4e6e8b4b0/guvukozudomijajedamo.pdfIn PDF document text
    • https://www.intermediastudios.com.mx/wp-content/plugins/super-forms/uploads/php/files/a8facaddd44d676fa7190225872aa691/2318643483.pdfIn PDF document text
    • http://www.siscbolivia.com/admin/uploaded/fck/file/mupirimosezuwukivabep.pdfIn PDF document text
    • http://stardentalcare.org/userfiles/file/gadapavuwebiru.pdfIn PDF document text
    • http://podiummoda.ru/userfiles/file/mafubene.pdfIn PDF document text
    • http://hesexpo.com/img/editor/image/file/nabozurixojub.pdfIn PDF document text
    • http://www.vitrierbxl.be/wp-content/plugins/formcraft/file-upload/server/content/files/16077f2bcbccee---bijovefet.pdfIn PDF document text
    • https://allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/196fb22f2ac52ae1898d3fde0d0a0c98/24462064070.pdfIn PDF document text
    • http://www.wallisandemmanuel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086c582a65b4---sulovibokujiw.pdfIn PDF document text
    • https://gservicepz.com/wp-content/plugins/super-forms/uploads/php/files/132ae4f388f42be23adb921d807ec3ec/47083055437.pdfIn PDF document text
    • http://www.ponderosafestival.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083178768638---63590235870.pdfIn PDF document text
    • https://sindonis.com/userfiles/file/milore.pdfIn PDF document text
    • https://bestmiamiturf.com/wp-content/plugins/super-forms/uploads/php/files/c30e70b8f5895c0d409c0530b0373ce6/62116014995.pdfIn PDF document text
    • https://fastcomputer.vn/wp-content/plugins/super-forms/uploads/php/files/8a0216decac352a902df5e4cfef1de41/71900618661.pdfIn PDF document text
    • https://amenagementsoleil.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086eacaac0b4---pilomineweduziduke.pdfIn PDF document text
    • https://cafepiolho.com/uploads/assets/xidegisugexuwexigu.pdfIn PDF document text
    • https://auto-rujo.com/images-editor/file/panokuramagizuf.pdfIn PDF document text
    • http://penzionnakrizankach.cz/ckfinder/userfiles/files/weladopadolo.pdfIn PDF document text
    • https://duext.com/wp-content/plugins/super-forms/uploads/php/files/d5a71646d6301b0709173587f97b168f/33076536624.pdfIn PDF document text
    • https://asset-books.com/userfiles/file/52011813266.pdfIn PDF document text
    • https://cutletsmeat.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072fe15633b9---64907886332.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=great+expectations+download+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee30.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE30 17264 bytes
SHA-256: b7543cad6913bb4ca7e2591d14fc28cb6c3a3e82e6f590543369f85d3b2ed394
font_01_sfnt_off00011b0d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B0D 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00013324.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13324 10840 bytes
SHA-256: ffff98a066135c96bdf17fdfde918d12f17ed2cf4471db6e629793f8c6d4072a

Open this report in the interactive analyzer, or submit your own file for analysis.