Malicious PDF — malware analysis report

Static analysis result for SHA-256 e786dc09f09c9926…

MALICIOUS

PDF

79.6 KB Created: 2021-06-08 14:36:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-29
MD5: d2860354a0c8cee5452db15d9fafce24 SHA-1: 49a4f82b2b8c3bd9eb46353814d30b73b0d010e7 SHA-256: e786dc09f09c9926558811e286ca41926abfa643a69e89805d880d05786faf72
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains numerous links to compromised WordPress sites and disposable hosting, suggesting a link farm designed to distribute malicious content. The embedded URLs and the document's structure point towards an attempt to trick users into downloading potentially harmful software, such as cracked applications.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/uplcv?utm_term=pirate+king+cracked+apk+download PDF link annotation
    • http://104.156.58.56/~web2inbox/wp-content/plugins/formcraft/file-upload/server/content/files/1608f1e67df2b4---lewiferetiginetivosopodi.pdfPDF link annotation
    • https://agenciaboom.com/wp-content/plugins/super-forms/uploads/php/files/rjqmnnv43pkvcdog4kgcs6ovu2/foverorexoka.pdfIn PDF document text
    • https://118highschool.am/wp-content/plugins/super-forms/uploads/php/files/024aaa763cb8859f2ab094eb0161aa27/vumumefanepupik.pdfIn PDF document text
    • https://www.karenlovelee.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b9b8f3ee255---fegemiravakul.pdfIn PDF document text
    • http://workprohealth.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608fbaecbfcd2---kumidezulikidujuvavet.pdfIn PDF document text
    • http://amblesidewindermere.ca/fckuploads/images/file/vemidoto.pdfIn PDF document text
    • https://ag-concept.ru/wp-content/plugins/super-forms/uploads/php/files/9144860666a67d1c3e10088c0f9e76f5/57694787520.pdfIn PDF document text
    • https://ventana-sur.com/wp-content/plugins/formcraft/file-upload/server/content/files/160854b6714936.pdfIn PDF document text
    • https://carlojans.com/cms/file/xomojesakeburojofed.pdfIn PDF document text
    • https://sketchup360.vn/wp-content/plugins/super-forms/uploads/php/files/rb7bbsqvaf8pr1kn9m382a7vja/rajalusuvotad.pdfIn PDF document text
    • http://julieesteban.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e83ff85221---13373100821.pdfIn PDF document text
    • https://www.syah.org/wp-content/plugins/super-forms/uploads/php/files/91c0031d041d0a254ed7e090e4abf347/7095462846.pdfIn PDF document text
    • http://plenaadoracao.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1606c8d885bc5f---48393955640.pdfIn PDF document text
    • http://braintradingbcn.com/wp-content/plugins/super-forms/uploads/php/files/7313f20b8341e6ab00e5bddef0de9c81/bavuposasavo.pdfIn PDF document text
    • http://berallebags.com/UploadFiles/FCKeditor/20210509051823.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD2C2 5220 bytes
SHA-256: 452482d5b04546e74db1b3694fd0eefb420fcf43902567b88f912ba70ebf9de3
font_01_sfnt_off0000e4a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4A1 3004 bytes
SHA-256: ee022d1435df78eef2a095f367deee5b2c9ff10781f625b44ffed7b0b18942c4
font_02_sfnt_off0000f151.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF151 10540 bytes
SHA-256: 0045cbb91fb24bacdfe2c579ac367056dc2b8dc4b9504640e48db7df70b99831
font_03_sfnt_off00011595.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11595 17220 bytes
SHA-256: 35edb5b9cbf02069a1c644b65641b99623ea43084c19b1d229c5e52ffc0b3968

Open this report in the interactive analyzer, or submit your own file for analysis.