Malicious PDF — malware analysis report

Static analysis result for SHA-256 9886d13505c4c432…

MALICIOUS

PDF

268.2 KB Created: 2021-07-31 14:27:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-24
MD5: e9e507ce73bcdc610c665df169979aa8 SHA-1: 18420c5482045bb59d0f94612edd0fbb26c74583 SHA-256: 9886d13505c4c432306a470f23835131ea7c02f7e00d55ea8edf7c4792b46036
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links, with at least one pointing to a compromised WordPress upload storage, suggesting a phishing or malware distribution lure. The PDF structure and embedded links are indicative of an attempt to redirect the user to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9028

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://beribuket.ru/wp-content/plugins/super-forms/uploads/php/files/4fe11319745c7f590cb39885267d2f12/49849641439.pdf In PDF document text
    • https://irantruck.ir/data/file/wijulusizalurafar.pdfIn PDF document text
    • http://btc-ltd.com/upload/file/49866002733.pdfIn PDF document text
    • https://new-baby.me/userfiles/file/66992466150.pdfIn PDF document text
    • https://wholisticvibrations.com/wp-content/plugins/super-forms/uploads/php/files/a26e1f0d5a1a945227f6b688dbc4a519/27752935955.pdfIn PDF document text
    • https://izharfoster.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ffe9064733---kozajarureruz.pdfIn PDF document text
    • http://iideree.org/wp-content/plugins/formcraft/file-upload/server/content/files/1608e58584e07f---katitudikazoxef.pdfIn PDF document text
    • http://www.kliningstroy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160c1b8fa87b94---4332069288.pdfIn PDF document text
    • https://marciasmithconsulting.com/wp-content/plugins/super-forms/uploads/php/files/0c2e0028aa1684d559ad711348bead63/guzulixiwobizipaxikametok.pdfIn PDF document text
    • http://fabtur.ru/upload/files/govirevamunepapa.pdfIn PDF document text
    • https://takiminsahada.com/wp-content/plugins/super-forms/uploads/php/files/1i3nbielsodvge0rdcumsa6vf0/tewedexig.pdfIn PDF document text
    • http://mgmkt.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16074393853723---34172771564.pdfIn PDF document text
    • https://www.chortho.co.uk/wp-content/plugins/super-forms/uploads/php/files/pv4totm70vf2kqikvma9k2hr5s/xabebamazimu.pdfIn PDF document text
    • https://pet-fashion.ro/mm/file/55436646591.pdfIn PDF document text
    • https://k9-warrior.com/wp-content/plugins/super-forms/uploads/php/files/q1e5umpgmraq5q2gmdidb3kket/zomezaz.pdfIn PDF document text
    • http://dellalontra.it/userfiles/files/sirifiregefuzelipum.pdfIn PDF document text
    • http://www.marcado.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160e4dac92f89e---55940762959.pdfIn PDF document text
    • https://dungcuruamui.com/wp-content/plugins/super-forms/uploads/php/files/ckvi1ts8toul1us4ci56lmi67u/siroladukijezorake.pdfIn PDF document text
    • https://jfefood.com/wp-content/plugins/super-forms/uploads/php/files/61614921ca9278ef37302d078ad2df92/42433046248.pdfIn PDF document text
    • https://yourlightingbrand.com/wp-content/plugins/super-forms/uploads/php/files/e741ef38e1f80e0f1a695e11b050071c/9239975037.pdfIn PDF document text
    • http://uro-medical.pl/zdjecia/fotki/file/90667770029.pdfIn PDF document text
    • https://metricgroup.it/uploads/file/86457182223.pdfIn PDF document text
    • https://estigotours.com/wp-content/plugins/super-forms/uploads/php/files/476b314f3fd13b7db77f291a9bf8b052/56614682750.pdfIn PDF document text
    • https://www.femregenx.co.za/wp-content/plugins/super-forms/uploads/php/files/7lj2uqcl4orsai9kq21l57jpoq/83663268434.pdfIn PDF document text
    • https://desertflying.club/wp-content/plugins/formcraft/file-upload/server/content/files/1608adb58086c9---tibutikidekevajuxig.pdfIn PDF document text
    • https://t4g.nasscomfoundation.org/wp-content/plugins/super-forms/uploads/php/files/apnl16oqs5f7926kpgoluh7da7/futular.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=ezra+pound+cantos+pdf+downloadPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003b566.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B566 10616 bytes
SHA-256: 80e54ce6a5c026746db2c6dc06fb30680980a02d8e2f60ced87c71a7906b4e33
font_01_sfnt_off0003cde7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3CDE7 22972 bytes
SHA-256: 14315edd83ebcc654fa969086dec14ec3e7a1de1011b703c5d3461f34b50c75e
font_02_sfnt_off00040917.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x40917 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.