Malicious PDF — malware analysis report

Static analysis result for SHA-256 e102e5722f63f8af…

MALICIOUS

PDF

317.4 KB Created: 2021-06-28 04:55:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 6dbddc658dcb9fe7ac69176b7601e147 SHA-1: 299dd69dd6df10f90df2d8b0cedb5b378034e614 SHA-256: e102e5722f63f8af24f28f886fc361832f7f2a41179fb2c9f684e26fb00e8e8a
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier indicating maliciousness. It contains numerous links to compromised CMS upload storage, suggesting it's part of a link farm designed to distribute malware. The presence of urgency lures further supports a phishing or social engineering attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9878

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://k9-warrior.com/wp-content/plugins/super-forms/uploads/php/files/sntp65kl3v1jcbg8ighqdf8hdd/sojaluzigenulivalezigoga.pdf In PDF document text
    • http://www.kzhep.in.ua/wp-content/plugins/super-forms/uploads/php/files/a99dbvlh8hdbm0cmps23u72qb2/jaraluvupavusizuvufoki.pdfIn PDF document text
    • https://www.straightmyteeth.eu/wp-content/plugins/super-forms/uploads/php/files/0541ac42b04e7ba10b3e8c041a93bd1e/dakumiguxubakixiwobaxa.pdfIn PDF document text
    • https://stewsites.com/wp-content/plugins/super-forms/uploads/php/files/1212d503e89f182279ff99073ee03da9/83246159078.pdfIn PDF document text
    • https://www.breastcancerfoundation.in/wp-content/plugins/super-forms/uploads/php/files/c541a262b55cec649d994f5761c3c644/56738587708.pdfIn PDF document text
    • http://watdoenwevandaag.nl/upload/vutalinezovijevurevabe.pdfIn PDF document text
    • https://chocoinmobiliario.com/wp-content/plugins/super-forms/uploads/php/files/84a45f7d820610431a76e9845f554dd5/49471961407.pdfIn PDF document text
    • https://www.prestigeautobody.com.au/wp-content/plugins/super-forms/uploads/php/files/932d1a445c96c820a3d1c70bd8440988/wufezux.pdfIn PDF document text
    • https://renebeumer.nl/userfiles/file/sefedanisotuvofudokev.pdfIn PDF document text
    • http://www.hptindia.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089efe533f3f---86336595094.pdfIn PDF document text
    • http://ferrocom-spb.ru/userfiles/files/zufijomufuvukotibilavopu.pdfIn PDF document text
    • https://tfnd.org/wp-content/plugins/super-forms/uploads/php/files/91f9cf55207e7b31b09aaecdfdf3ced1/lebufixugovomirubatu.pdfIn PDF document text
    • https://fjordancv.info/wp-content/plugins/super-forms/uploads/php/files/713d0c14cd88f0212c0089a461ac3265/miwidarasakisamixotatile.pdfIn PDF document text
    • http://www.appsolutely.sg/wp-content/plugins/formcraft/file-upload/server/content/files/1607d66b072ab0---90894766180.pdfIn PDF document text
    • https://www.rowtheerne.com/wp-content/plugins/super-forms/uploads/php/files/384399e3c1462e4860e961cc9f632735/62662027864.pdfIn PDF document text
    • http://mousike.it/img_ins/files/74783267445.pdfIn PDF document text
    • http://eduomania.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ad993f8f299---74985380713.pdfIn PDF document text
    • http://www.drop-lok.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607699969f6fa---bewetifitasajotonida.pdfIn PDF document text
    • https://temahr.hr/files/34112961539.pdfIn PDF document text
    • http://cga82.com/admin/File/wojogup.pdfIn PDF document text
    • https://chamsocmuihong.com/wp-content/plugins/super-forms/uploads/php/files/ucl19tb0nk14qoni10216klrqn/54681161835.pdfIn PDF document text
    • http://vekosgroup.ru/userfiles/file/dixezonen.pdfIn PDF document text
    • http://aliotoconsulting.com/clients/862286/File/43714816205.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=looking+for+lennonPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00048a79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x48A79 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0004a28b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4A28B 17780 bytes
SHA-256: 83ec7562dccabbabff05539acde5eb16a51669496d8a193319cf81eb3a33f5a5
font_02_sfnt_off0004d0ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4D0FF 10012 bytes
SHA-256: cb31763e7ccb3a9b1aeab6f9d1e8f1a7f94e0933bf6cc2110e069381ed19d5c9

Open this report in the interactive analyzer, or submit your own file for analysis.