Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddee2bce9bbcf7e9…

MALICIOUS

PDF

87.2 KB Created: 2021-05-24 01:31:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5273078067c9e479d41ba49c78fb6d17 SHA-1: 82285a03031c92657399d84aff54a1fa31401f98 SHA-256: ddee2bce9bbcf7e94994b6c24a20d5069b2330a7edc4ca44b978bf2e6f0b81fd
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains numerous embedded URLs, many pointing to compromised WordPress sites or other suspicious domains, suggesting a phishing or malware distribution campaign. The document body, though heavily obfuscated, appears to be a lure related to 'Oxido de aluminio al2o3 estructura de lewis'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9819

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oniceh.ru/uplcv?utm_term=oxido+de+aluminio+al2o3+estructura+de+lewis
    • http://www.johnknox.ch/wp-content/plugins/formcraft/file-upload/server/content/files/16094819aac377---pabewelupibujopowiliru.pdf
    • https://adepotcustom.com/UploadFiles/file/20210428011013131.pdf
    • http://xn--e1aaafipco3bk8gra3b.xn--p1ai/upload_picture/file/fupiwalodiguriwepunuso.pdf
    • http://timeyear-v.com/userfiles/file/12398551172.pdf
    • http://akcjonariusz.com/UserFiles/file/sokakewaladini.pdf
    • https://formapolis.it/wp-content/plugins/super-forms/uploads/php/files/29ab789959c28f16854e8165c45ad5e9/35456949876.pdf
    • https://www.hed-endo.hr/wp-content/plugins/formcraft/file-upload/server/content/files/1607c0dac86dc3---82026833608.pdf
    • http://ekotronic.eu/files/file/xatujumewavixavunaruguduv.pdf
    • https://armagedonspedycja.pl/files/file/tiralisejaxumazonuku.pdf
    • https://www.mozartcantat.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1609ee8fb910ca---25148188219.pdf
    • http://www.gcsystem.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16090ce7b86653---zimuxora.pdf
    • https://alarrabnews.com/images/content/content/file/95999518700.pdf
    • http://3duct.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a8021c03a19---seboronidedopewo.pdf
    • https://xn--64-mlcufjjaii0l.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/91dc495176159c88ff03d393bf0728c6/62953639713.pdf
    • http://aarogyamedico.com/userfiles/file/62525909416.pdf
    • https://suhrsmad.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1607edd37201b9---tebewevuvelodug.pdf
    • https://adm.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/f4ddd337cbff977a5ca16f1d8aba13d9/89524677473.pdf
    • http://fontawesome.iohttp://fontawesome.io/license/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f32.bin
b8f7c4830971207a367960352796a7673b3405e51adaa4e8f1212a9e04d601aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F32 1992 bytes
font_01_sfnt_off000118a1.bin
55aafe9599b8c1c928ec1c12b3502acfacc8c4c6a5a1a112ea2e1b4d2c714523		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118A1 5568 bytes
font_02_sfnt_off00012b92.bin
ba6fe089e4ec407a47b78213f06d51dc0e1793b8c6649165dd570e95ba9f36c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B92 13944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.