Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9e422fa3f5125a7…

MALICIOUS

PDF

205.0 KB Created: 2021-06-28 07:19:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 48e08af5f94392076bd01e2cd1648ca3 SHA-1: a9e9a2d5239b28745203e1c04102adda55d6a56f SHA-256: c9e422fa3f5125a7788ff6ff8f1decd517ef1cf36a2439ce42517ab00d003d03
106 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ML classifier and the 'Advance-fee lottery/parcel scam lure' heuristic strongly indicate malicious intent. The document likely serves as a lure for an advance-fee scam, presenting a fabricated scenario to defraud the user. Several URLs point to compromised WordPress sites, suggesting a pattern of hosting malicious files on such platforms.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9938

Heuristics 5

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xn--b1ahhafccpgkb2bxo.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/ec13023ad542fa70bdd8c72796656e86/tedanemesugavegibu.pdf
    • https://www.officinadelgustoroma.com/wp-content/plugins/super-forms/uploads/php/files/11ba3f9b0f626cbce5d6d5328feabb82/kiwojivimejigip.pdf
    • http://vibrosystem.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160b29b58d0433---regenodifodozevezudi.pdf
    • https://pensionatiitalianiinportogallo.it/wp-content/plugins/super-forms/uploads/php/files/1e15619557a06a078638369f44c29e3e/56148864131.pdf
    • https://advancedcheckcashadvance.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aae7216c707---60486299474.pdf
    • http://lookupagency.es/wp-content/plugins/formcraft/file-upload/server/content/files/160c79957d2893---lijowezozofolibudes.pdf
    • https://msr-hudsonproperties.com/wp-content/plugins/super-forms/uploads/php/files/05e2d1242cf47390e7a40eca444fd8c2/segajafareguranonogomob.pdf
    • http://nedirajtebosnu.net/userfiles/file/dovapugepogimegamiram.pdf
    • http://tantex.org/tantex/tantexuserfiles/file/979313937.pdf
    • http://banghetretunhien.com/media/ftp/file/vukopusujomonabod.pdf
    • http://vickerycarpet.com/uploads/images//files/18023102260.pdf
    • http://claudiodauelsberg.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16092df9e47942---japogukagifetad.pdf
    • http://www.birapart.com/wp-content/plugins/formcraft/file-upload/server/content/files/16095312e683a2---pilejivepavawogebomopam.pdf
    • https://ipcare.nl/wp-content/plugins/super-forms/uploads/php/files/27brlklsoq1db8qkhnr27f477c/21661378256.pdf
    • http://koszyczarek.pl/userfiles/file/favovuzutetirunimewunu.pdf
    • http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160821d74bee17---pusaxuzumabukefanosijora.pdf
    • https://tehnol.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16091737fbe9e0---87304613322.pdf
    • http://champaigncursillo.com/userfiles/file/katuferoxelu.pdf
    • https://parklanehotel.asia/userfiles/file/fosejirulet.pdf
    • https://www.schroedersales.com/wp-content/plugins/super-forms/uploads/php/files/b5b25bded1c5fbc92c7d8c55e2123b27/jijotilarimofuvikalun.pdf
    • https://www.hungryalex.com/wp-content/plugins/super-forms/uploads/php/files/a67a9f7a7d1891752648a850e3f305cd/78621791852.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/Om9ozkHLxGw/uplcv?utm_term=niall+horan+has+a+baby
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002c10a.bin
4321addcb16262f5eac767db2e9b3913e3f330f72a84ef815cf7c5a0684a0729		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C10A 10204 bytes
font_01_sfnt_off0002d7ce.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D7CE 16792 bytes
font_02_sfnt_off0002efe0.bin
31ba91e9ca9c46013aaadc81f12dd5a5fc5aa95480a1a30ebc966f272c5ebd59		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EFE0 20736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.