Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea8e700b1011a430…

MALICIOUS

PDF

314.2 KB Created: 2021-08-06 14:41:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-01
MD5: b06770dbc80d14317678fe9d1fbdc96f SHA-1: 4dd7a66ac05e9836f104a3ad842362617c5ef76e SHA-256: ea8e700b1011a430586300e7d7fbd0bdf54b066b4bdf4620a4e55668b79a2d54
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm, many hosted on compromised CMS upload directories. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9128

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/uplcv?utm_term=age+of+sigmar+battletomes+download PDF link annotation
    • https://elicopter-de-inchiriat.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160ce3cead0318---65804178032.pdfIn PDF document text
    • http://cistenivytahu.cz/upload/file/32614946963.pdfIn PDF document text
    • http://paradisetnl.com/FileData/ckfinder/files/20210731_1887BEF8216EBF5B.pdfIn PDF document text
    • https://giverny-bkk.com/upload/files/desuju.pdfIn PDF document text
    • http://cageart.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160ac311614b4d---dozesabidodomemajabaseguz.pdfIn PDF document text
    • http://www.anjhimayath.com/upload/file/ferivu.pdfIn PDF document text
    • https://iamluno.com/wp-content/plugins/formcraft/file-upload/server/content/files/160827bf62674f---jipitevekebe.pdfIn PDF document text
    • https://arhstroi.by/uploads/files/xesovulifu.pdfIn PDF document text
    • https://e-lightingcontrols.com/wp-content/plugins/super-forms/uploads/php/files/384ecaa91e3b27a692bf44c7fbe27f93/25878615246.pdfIn PDF document text
    • https://alphacleanwashing.com/wp-content/plugins/super-forms/uploads/php/files/0b757228a7e7f3b19d54519b91333803/kezimuxikamogipu.pdfIn PDF document text
    • http://angarakshaksecurity.com/userfiles/file/13656652725.pdfIn PDF document text
    • https://mtmnetwork.net/uploadEditor/files/bujagunukipe.pdfIn PDF document text
    • https://alphacleanwashing.com/wp-content/plugins/super-forms/uploads/php/files/5fd861c2923386a4bb6ddf1b5569c0f5/74632513132.pdfIn PDF document text
    • http://www.sarajevo-inn-grunewald.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609ec0e9a7c47---12442328168.pdfIn PDF document text
    • http://for-rent-aalst.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c55ed6872ef---boxaxagitigix.pdfIn PDF document text
    • http://hhcreunion.com/clients/4/43/43f38dc94a4d709fe78decf5bd9d7370/File/51227832745.pdfIn PDF document text
    • https://topinsolventa.ro/userfiles/file/4365859707.pdfIn PDF document text
    • http://laptopplus.be/app/webroot/files/userfiles/files/64586345783.pdfIn PDF document text
    • https://wlao.on.ca/wp-content/plugins/super-forms/uploads/php/files/6bd33777fade3a1c2a1b24ad4b12bf6d/lipagagavefijezofab.pdfIn PDF document text
    • https://elitteaccesorios.com/wp-content/plugins/super-forms/uploads/php/files/grfvljljshfodm9h3din1v63ju/3398626273.pdfIn PDF document text
    • https://www.ideaklinikankara.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f298f6e7f2---pafame.pdfIn PDF document text
    • https://systematix.pl/userfiles/file/kulipujotalododikofada.pdfIn PDF document text
    • https://www.mybizwebsites.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c45352ab658---32689823417.pdfIn PDF document text
    • http://herodumpsterrental.com/wp-content/plugins/super-forms/uploads/php/files/abbd75c8b822abdd5b74f2ab8a650df7/24180721320.pdfIn PDF document text
    • http://www.majorisinvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609c8f7272e94---80883596756.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000478be.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x478BE 18024 bytes
SHA-256: 49d89a5c0975637d91517984b70dd953e98055f3c1f81e7fdea35c7647c7ab13
font_01_sfnt_off0004a7b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4A7B8 10904 bytes
SHA-256: 3ec97be70f5f76023adee83b809ec705b19093216c9a62d31d6ab56d39db444d
font_02_sfnt_off0004c0cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4C0CD 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.