Malicious PDF — malware analysis report

Static analysis result for SHA-256 e21cb4eef449832f…

MALICIOUS

PDF

329.4 KB Created: 2021-06-28 06:04:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 8b39e113e9040c1b9c9c203d3db6f8fe SHA-1: 80295401c42d7dcef4aff74f5e227f38a5774909 SHA-256: e21cb4eef449832f2c907c166a8bf90a68c99f85340a5cc486b240e41e072b20
146 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document flagged by multiple heuristics, including ML classification and ClamAV, as malicious and phishing-related. The 'SE_CALLBACK_LURE' heuristic indicates the document likely prompts the user to call a phone number, a common tactic in callback phishing scams. While no scripts were explicitly extracted, the presence of numerous embedded URLs, many pointing to compromised WordPress sites, suggests a potential for further malicious activity or redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9724

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://coretry.ru/uplcv?utm_term=aniline+and+water
    • http://www.peplex.it/wp-content/plugins/formcraft/file-upload/server/content/files/16094f9b80bded---puzitusigena.pdf
    • http://novaserv.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077fd198f7f7---wodak.pdf
    • https://ecoinkworld.com/wp-content/plugins/super-forms/uploads/php/files/8871dd250a293dbea6e10b8f15b8c978/sesijopukurebazekuvibiw.pdf
    • https://outsourcedbackoffice.co.uk/wp-content/plugins/super-forms/uploads/php/files/120f10b4b9774a68227c614a04ecc035/firojidaviwi.pdf
    • http://graphicon.hu/wp-content/plugins/formcraft/file-upload/server/content/files/160769f694b45b---kegigo.pdf
    • https://www.picmephotoboothhire.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1608fb80c1e227---rovep.pdf
    • https://spherule.org/wp-content/plugins/super-forms/uploads/php/files/bebc8a11cda8cd96b139b7a6704ac926/27226336648.pdf
    • http://bukharageorgia.com/sites/default/files/file/29177478108.pdf
    • http://dochoiotovn.com/uploads/userfiles/file/67052532354.pdf
    • http://officinedesign.it/userfiles/files/17468365158.pdf
    • http://bhttourist.com/upload/fckimagesfile/fagitoz.pdf
    • https://www.sudburyhighspeedinternet.ca/wp-content/plugins/super-forms/uploads/php/files/0d98d6ea6cee7fe64bb9408e4fc21b4c/jitegijuxaduforagevosej.pdf
    • https://www.dishdivvy.com/wp-content/plugins/super-forms/uploads/php/files/095da5211c86fa20dd831054cbcf6831/zosiz.pdf
    • https://rmissio.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1609281ffd7bc5---pekibipijabovutuwakixed.pdf
    • https://mindweave.co.uk/wp-content/plugins/super-forms/uploads/php/files/mruomb525em7lkled090bcb10j/remesit.pdf
    • http://ecbpolska.pl/wp-content/plugins/super-forms/uploads/php/files/3b267c190d087b65e671e8484eb08777/sibufoxitakivim.pdf
    • https://www.qbuildsoftware.com/wp-content/plugins/super-forms/uploads/php/files/603aa126d664a6ff4b736a2f04030ee0/febujexe.pdf
    • http://svs-pm.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac32b0e1795---favunofije.pdf
    • http://www.caribbeandentist.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609720141f2de---54564291276.pdf
    • https://globalclassic.org/wp-content/plugins/super-forms/uploads/php/files/f8rfqccs13i92ogolsb6usljsi/59872956887.pdf
    • https://genericdiabeticteststrips.com/userfiles/files/jufudaxadameloz.pdf
    • https://wamsconference.com/wp-content/plugins/super-forms/uploads/php/files/7903b3231fd5f367d49f7addbee893b3/93985342058.pdf
    • http://nw-line.ru/generic/uploaded/95268213271.pdf
    • https://www.scanworld.se/wp-content/plugins/formcraft/file-upload/server/content/files/1608f0506749fb---28820607473.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00049306.bin
fd831f8a239d989b17d634ff15357c15abceab4494fee6227fe5cb1b70c826aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x49306 16304 bytes
font_01_sfnt_off0004a923.bin
90d9560b87863cdaf6372d04a89d5efff9edd3739354d35e3bb6552807b78fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A923 23996 bytes
font_02_sfnt_off0004e865.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E865 16792 bytes
font_03_sfnt_off0005007c.bin
4b45f8bd64448bb4c0f6c19b984515eb69254449381e7be12db943f54dcaaa49		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5007C 10020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.