Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9663cac78aae693…

MALICIOUS

PDF

84.6 KB Created: 2021-07-09 00:02:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 76d37f3dbc07cef1e7fccd8d40a6c8c9 SHA-1: af540becfb47a899ee68f372b31004084a6cfe02 SHA-256: a9663cac78aae6934541ec9dadc6e58ec23d4ddfbd8b072c616b38af4d3dadda
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous links to compromised WordPress sites, suggesting it is part of a link farm used to host malicious content. The 'SE_CLIPBOARD_COMMAND_LURE' heuristic indicates the document instructs the user to copy and paste content into a command-line interface, a common tactic for executing downloaded payloads. While no scripts were directly extracted, the ML classifier and ClamAV detection strongly suggest malicious intent, likely involving the execution of a secondary stage.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://neuragen.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160b9c130948db---samibagadixokubenuvurizaj.pdf In PDF document text
    • https://carea2plus.com/wp-content/plugins/super-forms/uploads/php/files/11d624e8d0d77518fc4b62318b473d3c/25212112142.pdfIn PDF document text
    • http://akinmedical.com/uploads/file/vivokizasejalubozuwidez.pdfIn PDF document text
    • http://slowjamsundays.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e54a19b912---jitabuzudubofezuxaxutalem.pdfIn PDF document text
    • http://collegium-connect.nl/ckupload/files/ramediganifojojo.pdfIn PDF document text
    • https://higher-reason.com/wp-content/plugins/super-forms/uploads/php/files/2plk1tq4vprj0c8cofq1minr6r/98210600585.pdfIn PDF document text
    • https://www.colegiodesafio.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/1607a226c10ce4---4587868901.pdfIn PDF document text
    • https://www.sblending.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160cface4bb6dd---39766925052.pdfIn PDF document text
    • https://www.temsilcisitesi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d389dc58bf---77782644903.pdfIn PDF document text
    • https://beautifullifeuk.com/wp-content/plugins/super-forms/uploads/php/files/f3e8993e581b5c6b0b71b0a91e1f16bf/majolulirome.pdfIn PDF document text
    • https://regeneracion-capilar.com/wp-content/plugins/super-forms/uploads/php/files/2ecc9aeaa74821f776cbb816825b6846/bumuwaxizazaja.pdfIn PDF document text
    • http://www.primalegal.eu/wp-content/plugins/super-forms/uploads/php/files/2j3f37cgkrrdko3unjl6pbeta6/98672655533.pdfIn PDF document text
    • https://anzmrrn.org/wp-content/plugins/formcraft/file-upload/server/content/files/160e6c2d51bb49---21850593644.pdfIn PDF document text
    • http://hintzfamilyreunion.com/clients/1/12/12a2788c5de59b93c87e4eff35998d4f/File/vigaruze.pdfIn PDF document text
    • http://henri-ruch.ch/doc_pub/file/rilazupaxozilijefiwow.pdfIn PDF document text
    • http://omonetach.pl/foto/ilustracje/file/34294140271.pdfIn PDF document text
    • http://www.gcsystem.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16087984cbd1d6---18279805949.pdfIn PDF document text
    • http://www.herbertvanderbrugghen.nl/draft/47049441407.pdfIn PDF document text
    • http://entone.es/wp-content/plugins/super-forms/uploads/php/files/82b309cb884a096ae1f8c83eeba60400/wupolemidabewekelis.pdfIn PDF document text
    • http://finsura-lifedirect.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16083d6617213c---mepudarotidodipo.pdfIn PDF document text
    • http://www.ambredore.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089a3777eb65---29865866999.pdfIn PDF document text
    • https://ag-concept.ru/wp-content/plugins/super-forms/uploads/php/files/6f5f55659cfa3cba5292bcbd68ec17e2/82286976918.pdfIn PDF document text
    • http://www.holderit.com/wp-content/plugins/formcraft/file-upload/server/content/files/160908000a83e0---26571750063.pdfIn PDF document text
    • http://www.brennholz-heinlein.de/wp-content/plugins/formcraft/file-upload/server/content/files/160770f8956ed8---69596584200.pdfIn PDF document text
    • http://trustarshida.co/cache/fck_files/file/fumezemisoti.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=how+to+make+pdf+from+multiple+imagesPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e44c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE44C 11004 bytes
SHA-256: b672285a9e7a79356d04ce72d740463d22a7236c11c7cc670679be87dabcd30e
font_01_sfnt_off0000fdaf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDAF 17744 bytes
SHA-256: 880e217035ab5578456dc9a78ef2e5e4ede77c5281a0081e700f748ddbb822d5
font_02_sfnt_off00012cb1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12CB1 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.