Malicious PDF — malware analysis report

Static analysis result for SHA-256 84d8bf567fec2121…

MALICIOUS

PDF

214.7 KB Created: 2021-06-23 23:37:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 6462227db4db34ce65beb12cecba321b SHA-1: 94dfee4efdc5233c4fedd747b3d06811464e6a8d SHA-256: 84d8bf567fec2121b42000f67bc39cb44c144c5d9e926efba5ef1aaef6d80d17
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous links pointing to compromised WordPress upload directories, suggesting it is part of a phishing campaign. The heuristic 'ML_NYX_PDF_MALICIOUS' and ClamAV detection confirm its malicious nature. The document body, though heavily obfuscated, appears to be a lure for downloading PDF books, which is a common tactic for distributing malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7977

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/uplcv?utm_term=rajiv+dixit+all+books+pdf+download PDF link annotation
    • http://bezagsecurity.cz/userfiles/vebise.pdfIn PDF document text
    • http://www.thebetterinsurance.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098babf1525d---wuguzovuwivepuvozoz.pdfIn PDF document text
    • https://www.horisunmauritius.com/wp-content/plugins/super-forms/uploads/php/files/acfc25a9da4b17553d26669ca6756a98/bukofotitugoxof.pdfIn PDF document text
    • https://www.hauptsache.cc/wp-content/plugins/formcraft/file-upload/server/content/files/1608174a02ef2a---lililapaju.pdfIn PDF document text
    • https://www.sharpeningfactory.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c8c54a9bbbc---naxuzukekodosaropifavozu.pdfIn PDF document text
    • http://graphicon.hu/wp-content/plugins/formcraft/file-upload/server/content/files/1609c175a10482---32100045961.pdfIn PDF document text
    • http://ljhalls.com/wp-content/plugins/super-forms/uploads/php/files/aca207e1e1ef4dc3bdec1f221feb8d7c/rotonaso.pdfIn PDF document text
    • http://phillipwhiting.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4edd46745d---50143133529.pdfIn PDF document text
    • http://midiabyz.com/wp-content/plugins/super-forms/uploads/php/files/4dfcb134a789ddcb5e3e0b7ad61b6246/98560128088.pdfIn PDF document text
    • https://loan-financial.com/wp-content/plugins/super-forms/uploads/php/files/135a912e9adf49c00d39516bbcaee4ae/53705553013.pdfIn PDF document text
    • https://mindweave.co.uk/wp-content/plugins/super-forms/uploads/php/files/jhj6pka70kgeq0imamicsf7bmi/revavosevatiripi.pdfIn PDF document text
    • https://schreinerheusi.de/wp-content/plugins/formcraft/file-upload/server/content/files/16081fac02b110---zivufoxarelo.pdfIn PDF document text
    • https://pensionatiitalianiinportogallo.it/wp-content/plugins/super-forms/uploads/php/files/55cfcd1a99e89b16ee715f55d04184dd/benesadez.pdfIn PDF document text
    • https://leunamgroup.com/wp-content/plugins/super-forms/uploads/php/files/f925dc5efa24485b8c1a3fd2aa42d213/xugubagebagidofapage.pdfIn PDF document text
    • https://actorconseil.com/files/file/wisusabelazegowobo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off0002f6f8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2F6F8 18052 bytes
SHA-256: 820b687f137e54573a11815ed3a0e28b73e2925dd39850cb6cee282fe4138a1d
font_00_sfnt_off000283dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x283DD 8724 bytes
SHA-256: ff5b50351f49babe6ad5f0523d178286ebc10adeb4aedd9c8fe313232b7753cc
font_01_sfnt_off0002a09f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A09F 5116 bytes
SHA-256: 080b89f6dbfabefd9771074110a5bd984540596e8121d4d620b6e562a112c26a
font_02_sfnt_off0002b220.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B220 2072 bytes
SHA-256: 67c010d91ad2969e27e11eeae3b2ea8a14fcd46f6d6daf3639c31ed584408d36
font_03_sfnt_off0002bba3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BBA3 20144 bytes
SHA-256: ecbc3bfd679130e84a7078cd3fdb2f080ed4e02263020204593b763a7f6cc514
font_05_sfnt_off0003137f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3137F 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378
font_06_sfnt_off00032180.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32180 13772 bytes
SHA-256: 88ec684a7270611f9d0f2c8af4f68fc70139ad432ac65a6ee5b1b50878175058

Open this report in the interactive analyzer, or submit your own file for analysis.