Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6e600c2b3625894…

MALICIOUS

PDF

171.6 KB Created: 2021-06-17 21:10:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 53d96d84dc9fc1a870bf217cbff4073b SHA-1: e5aeff0d5cebb41bedeaeb8cda3bfe50a7db8637 SHA-256: e6e600c2b3625894816c93baaf501de214f2ba7cec797279775d49ccb02be4ff
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell T1203 Exploitation for Client Execution

This PDF document exhibits malicious behavior, as indicated by ClamAV detection and ML classification. The 'SE_CLIPBOARD_COMMAND_LURE' heuristic suggests the document instructs users to copy and paste content into a command-line interface, a common tactic for executing malicious payloads. The numerous embedded URLs, many pointing to compromised WordPress sites, likely serve as download locations for secondary stages or phishing lures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9352

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://archism.ru/uplcv?utm_term=rufus+3.8+windows+10 PDF link annotation
    • http://www.davidwoodpersonnel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16085a3dc77035---lalibuvimoxiluwiv.pdfIn PDF document text
    • https://gz-topstar.com/wp-content/plugins/super-forms/uploads/php/files/2e3b52906dfbc91e2385c1abad74d490/jedamunudiwidoso.pdfIn PDF document text
    • http://www.brennholz-heinlein.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608d06a49e227---buxebekufilaj.pdfIn PDF document text
    • http://www.assignproject.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b4af308e07---50519610758.pdfIn PDF document text
    • http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/75c97e516aee2331d56b20ae280f88fb/67138314997.pdfIn PDF document text
    • http://vilaportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075e26ec7d37---57151714980.pdfIn PDF document text
    • http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ada48bf3e3b---fiburimuzamakosefiral.pdfIn PDF document text
    • https://afriqueitnews.com/wp-content/plugins/super-forms/uploads/php/files/7692b263561d2eb92bdc8430915b5121/48410178944.pdfIn PDF document text
    • http://eros-arena.de/eros/userfiles/file/50291084544.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609481880ff15---xulidinuzep.pdfIn PDF document text
    • http://for-rent-aalst.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083531787424---vibatero.pdfIn PDF document text
    • https://mebelpozakazu.ru/wp-content/plugins/super-forms/uploads/php/files/99e2ed0a46f42a867e697cc76ba6525d/28078079984.pdfIn PDF document text
    • http://www.thediethub.in/wp-content/plugins/formcraft/file-upload/server/content/files/160cad42b34cc5---71281411926.pdfIn PDF document text
    • http://skybuildinfraprojects.com/uploads/fukajemekuk.pdfIn PDF document text
    • https://macleanpinesdrivingschool.com.au/wp-content/plugins/super-forms/uploads/php/files/56d7a8df3a565043e73e60a5d859fbde/fijeveki.pdfIn PDF document text
    • http://www.gametimecatering.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a66f4daa8ed---81150086956.pdfIn PDF document text
    • https://www.partyshuttlebus.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160845d15b1f64---livawefozidovunako.pdfIn PDF document text
    • http://mountmedpharmacy.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1606e38d84e19f---lejomi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • https://pan.baidu.com/s/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • http://sinhala.sourceforge.net/In PDF document text
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITSIn PDF document text
    • http://www.gnu.org/licenses/gpl-2.0.htmlIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fba8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBA8 75724 bytes
SHA-256: 9de75d3252d7b4d45ff3446c4f6f8d7ea9a7547be83ff8f5d10bb777523c671c
font_01_sfnt_off0001df18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1DF18 5244 bytes
SHA-256: 6d025a3fb1951692575fb44df445107b3919b718b2fbe5dc0f733be101674ab0
font_02_sfnt_off0001f130.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F130 4140 bytes
SHA-256: b7882c459d94d9fb05ee491b72d0ee9c35e8d4bc9ed5787c7a0b3ba78fd6bc86
font_03_sfnt_off0001fe17.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1FE17 3840 bytes
SHA-256: 869700f7b438b0b0f23cfbf3a170597ae1a6b01e9ba9f60fe7298d5eefb98f81
font_04_sfnt_off00020c20.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x20C20 12076 bytes
SHA-256: 1f0fee118ba057e8bd49ceec3314af20d4f2cdfd913b9f3fec390bc72c670f72
font_05_sfnt_off00021c8a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21C8A 6148 bytes
SHA-256: 0b38f6fd5e0b54bfa22d5adee1cfe00629fe134100fc7cfc1ad14a2ab7974207
font_06_sfnt_off00022c6a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22C6A 17240 bytes
SHA-256: bfe81cc194a92b19e435bca06ecd4c4b9f9bd586c4c3c31030b297d37946f5e0
font_07_sfnt_off00025e7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25E7B 18924 bytes
SHA-256: 1f1106487987f03d2713705cb901c5f4350da0910768337b5519919d17b647c5
font_08_sfnt_off00027dab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27DAB 2752 bytes
SHA-256: e68b24175d5971d76b4c28d2c0db5c95ec99c51429de742704ab5baffc55f2f0
font_09_sfnt_off00028899.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28899 1812 bytes
SHA-256: 0da5bfcd1cedab720e8ffe1ba73c86d1ba322950d2cdf39f6da8b4f593077eae
font_10_sfnt_off00029027.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x29027 2608 bytes
SHA-256: d404f64416bf1ff5ad76d6d0ab30c7620aa9735638cfece5436aad8d6ad80edc

Open this report in the interactive analyzer, or submit your own file for analysis.