Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7c2b47ded502eca…

MALICIOUS

PDF

97.1 KB Created: 2021-07-27 17:04:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: b69855177b209837a2cb7fa711c6fe52 SHA-1: b11d7f1110a05ec7537a40c8d57e3039b75b2310 SHA-256: c7c2b47ded502eca4976412e5c827dc0eba08262cf09807b8e809b263a962a23
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link farm pointing to compromised WordPress sites, suggesting a lure to download a password-protected archive. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the structure and heuristics point towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9726

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vudafrique.com/wp-content/plugins/super-forms/uploads/php/files/c395fbcd15e150318745b875d12a11a6/baxesujafowexoferederogu.pdf
    • http://hkacca.com/userfiles/90268353351.pdf
    • https://ehblending.com/wp-content/plugins/super-forms/uploads/php/files/03f47cffb38fbe8e0e0e8b8567e7b376/jejosutebotikebedufixi.pdf
    • https://altonika.pro/files/fck/file/jegolewapebo.pdf
    • https://yocarbroker.com/upload/ckfinder/files/xafipudimakalesozomopo.pdf
    • https://eastmanllc.com/ckfinder/userfiles/files/68768489673.pdf
    • https://allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/9e16e50307debc0767fc1c6d417357f8/bukamalonulutekumuwef.pdf
    • http://morebricks.com/ckfinder/userfiles/files/32267273696.pdf
    • https://apoc.com.au/wp-content/plugins/super-forms/uploads/php/files/1ac931532d643ca339b0cc2adde04781/mizezivisipopugililix.pdf
    • http://leap-egypt.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c28548b775---gusijetilutepopinotafavoz.pdf
    • https://www.modianodesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bdd27654408---sometizikakemeniru.pdf
    • https://bataretak.com/img/files/file/jamoxijagugobatu.pdf
    • https://www.certificagreen.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089f4c1bed0b---66098841783.pdf
    • https://artsketch.ru/wp-content/plugins/super-forms/uploads/php/files/65fea2159df4c27d3c2f57c0f1cc794d/12544946815.pdf
    • http://www.sunarozlem.com.tr/wp-content/plugins/super-forms/uploads/php/files/moiuaopg5n6nspv9hq984d5r77/59685557795.pdf
    • http://xn--939a66v0zjo3bcvdmrp.com/data/ckfinder/files/lasesumumuxotuwavetoziju.pdf
    • http://canigrup.com/userfiles/file/valafobibudosonejuxazu.pdf
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d393be7382---tefexap.pdf
    • https://alixdemassy.fr/userfiles/file/72506681774.pdf
    • http://www.investing-in-women.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608471ee0efd0---21251364321.pdf
    • http://xn--80aafbkbafwdti1ahihccrg.xn--p1ai/pict/file/wabejub.pdf
    • https://pet-fashion.ro/mm/file/8186647116.pdf
    • http://clearlakesd.org/wp-content/plugins/formcraft/file-upload/server/content/files/1608a103876710---mixuzuvinaju.pdf
    • http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/160c40464922c4---ravodazorejoxebigivoj.pdf
    • http://3bbb.fr/ckeditor/upload/files/5766344553.pdf
    • https://www.adcgrain.com/wp-content/plugins/super-forms/uploads/php/files/042ff19b87055fa673dd8e128930603f/74823031889.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/Om9ozkHLxGw/uplcv?utm_term=cade+simu+3.0+download+instala%C3%A7%C3%A3o+gratuito
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f883.bin
c646bdeacf24634ec02ceeb9f9855706e95ce0d451c72927be4be5a819f22585		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF883 11632 bytes
font_01_sfnt_off0001139a.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1139A 16792 bytes
font_02_sfnt_off00012bac.bin
2265db50e2c6700bac8eb43a381529a49b1163e3ff77ca5c30a2e38928773984		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BAC 20420 bytes
font_03_sfnt_off00015dbf.bin
7d15b2d6d265aaca51dda18faee70a1b8fa9d95ed54cb111fb0895789092f9ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15DBF 16312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.