Malicious PDF — malware analysis report

Static analysis result for SHA-256 a64ce6902bab3a15…

MALICIOUS

PDF

239.6 KB Created: 2021-08-05 05:26:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: 8ea59a0b44012208cada1b8f90d04c64 SHA-1: b3803d1480f7ea4495b9e322128443d20bd3e05c SHA-256: a64ce6902bab3a152b6636fd1645f8c6d096e5fcfb1faf0a3bd39f5d52acf11b
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many pointing to compromised WordPress upload directories, suggesting an attempt to redirect users to malicious content or download further payloads. The document body is heavily obfuscated and unreadable, providing no direct clues to its intent beyond the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9774

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crysiq.ru/uplcv?utm_term=why+do+hells+angels+use+81 PDF link annotation
    • https://hightechrustremovers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160b6896ca23e4---91660405082.pdfIn PDF document text
    • https://dolmalatrek.com/userfiles/file/dovevixageripeba.pdfIn PDF document text
    • https://www.reparaciondebomba.com.ar/wp-content/plugins/super-forms/uploads/php/files/4f74dnl8gd2i5ev3en3g5hl3f0/berupesipifimopa.pdfIn PDF document text
    • https://dutchfansitenetwork.nl/ckfinder/userfiles/files/95129792788.pdfIn PDF document text
    • https://giriconsultancy.com/content_files/files/kuwafutalazijunigax.pdfIn PDF document text
    • http://furkansigorta.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160bc5ca0f2ddc---xavubuzezirebep.pdfIn PDF document text
    • https://autotrans911.com/thread/admin/uploads/file/48754961003.pdfIn PDF document text
    • http://thanhlamresort.vn/wp-content/plugins/formcraft/file-upload/server/content/files/1610b387d9f13d---72823341205.pdfIn PDF document text
    • http://www.fattyweng.com.sg/wp-content/plugins/formcraft/file-upload/server/content/files/160b3d8777b241---fulisubipexu.pdfIn PDF document text
    • http://hyundaihungthinh.com/uploads/images/files/difexuxejuganuxuzewopapa.pdfIn PDF document text
    • https://peiitw.com/Upload/ckeditor/files/47394833995.pdfIn PDF document text
    • http://2girlstrippin.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac8a0bd206f---webejurefoneberirugopeno.pdfIn PDF document text
    • https://hizlipin.com/calisma2/files/uploads/70180337160.pdfIn PDF document text
    • https://fitnessrev.net/wp-content/plugins/super-forms/uploads/php/files/06frsh6m8tkl132bf7fhlgop85/18495606729.pdfIn PDF document text
    • https://warungmimpishio.com/contents//files/kemetod.pdfIn PDF document text
    • http://www.hkwebdesign.com.hk/wp-content/plugins/formcraft/file-upload/server/content/files/160c191c838e24---vefuxusisenojakevis.pdfIn PDF document text
    • http://baovevietnam-vnss.com/upload/file/84597979396.pdfIn PDF document text
    • http://miroslaws.com/ckfinder/userfiles/files/tibok.pdfIn PDF document text
    • http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bd104f34f23---41245000058.pdfIn PDF document text
    • https://sjalikave.hu/pictures/file/likiwerur.pdfIn PDF document text
    • https://www.americanapi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160759707a06f4---gunurovirofajimoxoripapo.pdfIn PDF document text
    • http://ngocvietbungalow.com/upload/files/34703103718.pdfIn PDF document text
    • http://teplospectr.ru/images/files/70068141369.pdfIn PDF document text
    • https://binhruamuinanobac.com/wp-content/plugins/super-forms/uploads/php/files/jeim4jn6el19c8g6on9mb05ml2/89057419421.pdfIn PDF document text
    • http://sushrutproctology.org/ckfinder/userfiles/files/nomopikebajom.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00031607.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31607 19508 bytes
SHA-256: c790f13c177c8cdb47077f9f2e97d973629b45eeda0de5df06200fd669a784aa
font_01_sfnt_off000337bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x337BC 32316 bytes
SHA-256: 0ca15d4c046ef7da320d9c22e9cd5cc83213c11e2a3c110b09bcc866a8190d61
font_02_sfnt_off00037efb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37EFB 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off00039712.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39712 10704 bytes
SHA-256: 85403279a71086e651bc2d2b8e42ac858500d84ad6d70db57c4e48577eb705f4

Open this report in the interactive analyzer, or submit your own file for analysis.