Malicious PDF — malware analysis report

Static analysis result for SHA-256 84c5578ac8e6156d…

MALICIOUS

PDF

94.7 KB Created: 2021-06-26 19:21:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: bfd4bcbe7484a399019c32013ad51ce7 SHA-1: 6f57dad5f58c860e183e8b2d156bbc33a81893fd SHA-256: 84c5578ac8e6156d282e81186ef4076b1b2ed4c9d7ac3b002fe3072f2bd94e62
204 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1190 Exploit Public-Facing Application

The PDF contains embedded JavaScript and multiple external URIs, many of which point to compromised WordPress upload directories. The heuristic 'SE_PAYMENT_REDIRECT_LURE' strongly suggests the document is designed to trick users into believing there are new or changed banking instructions, a common tactic in business email compromise scams. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 8

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cosalesrep.com/wp-content/plugins/super-forms/uploads/php/files/dae19843c1d5eafda325891eb4c87a67/51496672493.pdf In PDF document text
    • http://onishi-kyosendo.jp/archive/zanimipugikatowepet.pdfIn PDF document text
    • http://www.aluvascientific.com/UserFiles/file/luvetutobevutirumesuf.pdfIn PDF document text
    • http://premiumresourcing.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609f7df6b0900---simitufog.pdfIn PDF document text
    • https://ph2020.org/FCKeditor/file/kexupopiwaponexemotuledan.pdfIn PDF document text
    • http://endustriyelkiralama.com/wp-content/plugins/super-forms/uploads/php/files/uh5l0a9rv7sgd8t6lssf96nvp6/56286901570.pdfIn PDF document text
    • http://americanpetrochemicals.com/customers/CMS-IMAGES/file/befivuvafoxobebi.pdfIn PDF document text
    • http://maduraicaterers.com/app/webroot/js/ckfinder/userfiles/files/39837265805.pdfIn PDF document text
    • https://www.ezhealthcheck.com/wp-content/plugins/super-forms/uploads/php/files/pslrqe4533990ngu92jssfpm4p/xowekurajizakiz.pdfIn PDF document text
    • http://poorclarescork.ie/images/lokorenedobesogura.pdfIn PDF document text
    • http://www.sg-callenberg.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608e3270c9b2e---fazezurafovidavo.pdfIn PDF document text
    • https://theemperorsoldclothes.co.uk/wp-content/plugins/super-forms/uploads/php/files/ojtr3quriodgfucgimk65stagp/35667639639.pdfIn PDF document text
    • https://solarconsulting.org/wp-content/plugins/super-forms/uploads/php/files/d425f909f6c6528aa6dfb919b28eff70/18309248236.pdfIn PDF document text
    • http://bhhangkhong.com/upload/images/files/74572459068.pdfIn PDF document text
    • http://veterina-hrib.cz/user-uploads/files/4351208485.pdfIn PDF document text
    • http://www.marcelasemper.com/wp-content/plugins/formcraft/file-upload/server/content/files/160858bc1aa1fc---najamagelavadoluvokilusa.pdfIn PDF document text
    • https://playgametoday.ru/wp-content/plugins/super-forms/uploads/php/files/fc779c63b1668611eab05f7f5578bebb/sakedazeda.pdfIn PDF document text
    • https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/1d3a73d582c1787572f87dd1610593e8/98454878494.pdfIn PDF document text
    • https://www.alertgy.com/wp-content/plugins/super-forms/uploads/php/files/550daaf5c23e426be6e839cdced7ddf9/64698020750.pdfIn PDF document text
    • http://www.ibadirect.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cfd7124abdf---63015623866.pdfIn PDF document text
    • http://www.belladermeestetica.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607a40194fc7f---71821913635.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=withdraw+from+circulationPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6C6 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00010ed8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10ED8 24472 bytes
SHA-256: c5a7f99cdf94bc5361e359f8b071b44098f643adbe4c793a969b8aec34e10b88
font_02_sfnt_off00014af4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14AF4 2384 bytes
SHA-256: b337caa5173463928754652904a7a8a98f1b0906da411461fdfa58a4b1f722a6
font_03_sfnt_off00015544.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15544 10620 bytes
SHA-256: 5bcba139eeb5863839e066e65a66ff2ffc5d451a59651d8dc9e479f22207b614

Open this report in the interactive analyzer, or submit your own file for analysis.