Malicious PDF — malware analysis report

Static analysis result for SHA-256 c31561ed74017d1c…

MALICIOUS

PDF

78.3 KB Created: 2021-06-09 14:59:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: a2081ffd122c6b5638146e9f8ae97a93 SHA-1: 73b078c38b7d914f3187623ab82db97e3ed7c1f2 SHA-256: c31561ed74017d1ca32eaca481dc085dfbb918a0a3e58b30870cb89c662fe2dc
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing lure. The document body, though heavily obfuscated, contains text related to 'wkhtmltopdf' and 'Qt', suggesting it may be a generated document. The presence of numerous external URLs, many pointing to compromised WordPress sites, indicates a link farm designed to redirect users. The 'SE_BROWSER_INSTALL_LURE' heuristic strongly suggests the document's purpose is to trick the user into installing malicious software disguised as a browser update or extension.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/uplcv?utm_term=himnario+adventista+pc PDF link annotation
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a404c777a54---fararigubazifupodas.pdfIn PDF document text
    • http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b1304ad20d0---53861221621.pdfIn PDF document text
    • https://annjulieskarpmo.com/userfiles/file/bowizezudekavagofuzidiwi.pdfIn PDF document text
    • https://izharfoster.com/wp-content/plugins/formcraft/file-upload/server/content/files/160afe176e4103---towuxejuzaxetofevo.pdfIn PDF document text
    • https://seataclighting.com/wp-content/plugins/super-forms/uploads/php/files/0b67cb43ca9da0baf62954259eb5cdcb/13717007817.pdfIn PDF document text
    • http://al-bandak.com/userfiles/file/67909529342.pdfIn PDF document text
    • https://lightupalife.org.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16089b55411ec1---71441342041.pdfIn PDF document text
    • https://prsnashville.com/wp-content/plugins/super-forms/uploads/php/files/00d84f8e9caba1ce3e7885daa8fa817d/dujakuxokamirumop.pdfIn PDF document text
    • http://www.cargeacrew.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607500cf9a392---refinutenuti.pdfIn PDF document text
    • http://bmcnx.com/userfiles/file/wufezaditorubezozeneb.pdfIn PDF document text
    • http://www.hypnotiseur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609868514b0c9---71997738816.pdfIn PDF document text
    • https://qualitylightsolutions.com/wp-content/plugins/super-forms/uploads/php/files/b6e1a6eb28ef8e2a4fe4a608629f2f84/12993754868.pdfIn PDF document text
    • https://www.cukoyem.com.tr/wp-content/plugins/super-forms/uploads/php/files/msalelldlp0f1hgthgc3qrjhl5/99248995447.pdfIn PDF document text
    • https://yourlightingbrand.com/wp-content/plugins/super-forms/uploads/php/files/4aae33a0d6f39bf43a72c21e786cc712/32265012537.pdfIn PDF document text
    • http://steclotildehorton.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160ac0b9c1ac61---58423118418.pdfIn PDF document text
    • http://www.icodar.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb4a9049e5a---rewujopamefovinazufobe.pdfIn PDF document text
    • https://www.helpfulhunks.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607f7cfe6a704---fegisukeduzot.pdfIn PDF document text
    • http://dieta-plus.pl/userfiles/file/ravona.pdfIn PDF document text
    • https://www.lightingsolutionsal.com/wp-content/plugins/super-forms/uploads/php/files/9e6c82cff893278e331aceed0267008c/76519115787.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f466.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF466 5208 bytes
SHA-256: e7e80f9fc43da7bc610b26e878dd75f0d66f220befb1e43bff0bb034e6ea991c
font_01_sfnt_off00010607.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10607 11672 bytes
SHA-256: 353856d6f8f4c294be74f99729c6b536c52d119493f9207e7b28dab34ca158df

Open this report in the interactive analyzer, or submit your own file for analysis.