Malicious PDF — malware analysis report

Static analysis result for SHA-256 9bc96978c58e94fe…

MALICIOUS

PDF

80.5 KB Created: 2021-09-06 06:59:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: ce609aa80b9cf22f0d0365186a5c5605 SHA-1: b3d200d000ea3975d99891f073d8d752df809d01 SHA-256: 9bc96978c58e94fea923e58f9e2a65150febdcb2960a5a7e3606999d81271e5f
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF containing embedded JavaScript, which is often used to exploit vulnerabilities or redirect users to malicious sites. Several heuristics indicate the PDF is part of a link farm hosted on compromised WordPress sites and disposable hosting, suggesting a phishing or scam campaign. The embedded JavaScript likely facilitates the download or execution of a secondary payload, as indicated by the PDF_JS heuristic and the presence of numerous suspicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9917

Heuristics 9

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://hps-gruppe.com/wp-content/plugins/super-forms/uploads/php/files/qh09t927kp7i7d8qidj9vnsgm8/64015930154.pdf In PDF document text
    • https://wacee.net/wp-content/plugins/formcraft/file-upload/server/content/files/160917b07ac8e9---57004818050.pdfIn PDF document text
    • http://headlinesdinerla.com/uploads/files/9710559388.pdfIn PDF document text
    • https://ingmarcomantovani.it/file/futaterijabidiwulisa.pdfIn PDF document text
    • https://soyana.de/js/ckfinder/userfiles/files/tajubojozusutobujapato.pdfIn PDF document text
    • http://exactblue.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083b6ddc1f2b---79553780031.pdfIn PDF document text
    • http://exactblue.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c1872106df---warasezuragutiba.pdfIn PDF document text
    • https://floorco.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/f292cf242d8f653883d30c3f133bba6e/tasebadozoxejigikapanaves.pdfIn PDF document text
    • http://daglichtfilters.nl/ckfinder/userfiles/files/73625087020.pdfIn PDF document text
    • https://xn--80aaaglcftt5alesfkk7f.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/76e022796dcecc38449016da6e2a5729/veratezanewunaluwoxalu.pdfIn PDF document text
    • http://104.156.58.56/~web2inbox/wp-content/plugins/formcraft/file-upload/server/content/files/1609e5ba93894e---vimimopidu.pdfPDF link annotation
    • http://www.thelawchamber.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609948d05e6e5---20956833259.pdfIn PDF document text
    • http://eg-connect.com/uploads/editorfiles/file///bonidozulagutivunutiti.pdfIn PDF document text
    • https://roofmed.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16072fbc77a443---31507865589.pdfIn PDF document text
    • https://beytarimcilik.com/admin/editor_resim/file/tisenopuvigalojagesivab.pdfIn PDF document text
    • http://www.psstrecno.sk/wp-content/plugins/formcraft/file-upload/server/content/files/160707d320686d---2937708712.pdfIn PDF document text
    • https://iominneapolis.com/wp-content/plugins/super-forms/uploads/php/files/b13177ff518cdcdce514efe643bd69d0/bereworix.pdfIn PDF document text
    • http://ackerviewguesthouse.com/userfiles/file/fosawo.pdfIn PDF document text
    • https://mandalaconfeccao.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1608504c2b070d---givewolegoku.pdfIn PDF document text
    • http://www.canadiantreasurer.com/wp-content/plugins/formcraft/file-upload/server/content/files/160878d591032a---faxijidudowujub.pdfIn PDF document text
    • http://janjoling.com/public/ckfinder/userfiles/files/11629488795.pdfIn PDF document text
    • https://lllk.ru/wp-content/plugins/super-forms/uploads/php/files/01d23025b933a9ff1f7aaf3af19d5155/jajeroxomeromejewof.pdfIn PDF document text
    • https://www.idromeccanicasrl.com/idromeccanicasrl.com/wp-content/plugins/super-forms/uploads/php/files/d712e5cf7105060e72c9f70fb5fc9b28/49051094606.pdfIn PDF document text
    • https://fiberglasssupplydepot.com/userfiles/file/tuvuri.pdfIn PDF document text
    • https://an-professional.ru/img/files/file/rokoboloxipakegatogule.pdfIn PDF document text
    • https://yuanfuconstruction.com/ckfinder/upload/files/lenifejazuforirujigeram.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/fzgW7-mxBc0/uplcv?utm_term=chemistry+in+everyday+life+class+12+important+questions+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD1EE 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000ea05.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA05 11516 bytes
SHA-256: 030d8b68cc9cde2eec9bd4e407df8ebe9d818ff1a68ec616fd6a6b04fb04b4f3
font_02_sfnt_off0001050b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1050B 18404 bytes
SHA-256: 5edf15d4fdbee03359b8490faafbeef3606a0b9ebf43fcc28550a4be75a442ca

Open this report in the interactive analyzer, or submit your own file for analysis.