Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef7114a347d5ed16…

MALICIOUS

PDF

81.7 KB Created: 2021-09-05 22:18:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 20fcb03b04cc6de067be517259645256 SHA-1: c32a1f75b37a3f1eaaf76fb3a6e71fd219c464e0 SHA-256: ef7114a347d5ed161602cae704f45da97d97b93d036f0fa26c7170b76e07bbf0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains numerous links to external websites, many hosted on compromised WordPress installations, suggesting a phishing or malware distribution campaign. The presence of embedded URLs and the nature of the heuristics indicate an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/uplcv?utm_term=blockchain+full+tutorial+pdf PDF link annotation
    • http://www.radiopopiatej.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f0f9d5f9fb---89365446357.pdfIn PDF document text
    • https://www.formwork.co.uk/wp-content/plugins/super-forms/uploads/php/files/gchia9k1hpjpc3345u1ccpfb8c/dizewuravutefuguxoja.pdfIn PDF document text
    • https://leuphuotcamap.com/uploads/image/files/nejodanisifaxokuv.pdfIn PDF document text
    • http://paymentsbusiness.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160960777122d4---nixanibalufegimipe.pdfIn PDF document text
    • http://www.heksan.com.pl/file/newewovofipi.pdfIn PDF document text
    • http://neuragen.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609cf5f052293---nufebemajebeputotu.pdfIn PDF document text
    • https://www.adelaarenergy.com/wp-content/plugins/super-forms/uploads/php/files/jut8o5dhl516vc4kbq24n6qi2c/30210127173.pdfIn PDF document text
    • http://adabaskimerkezi.com/upload/file/15360934103.pdfIn PDF document text
    • http://7tec.ru/userfiles/files/16868621109.pdfIn PDF document text
    • http://infrabud.eu/fckpliki/file/felugesurutegin.pdfIn PDF document text
    • https://www.lightingsolutionsinc.net/wp-content/plugins/super-forms/uploads/php/files/8c94b17d1c6bc7bcf2b31747e9ccb280/62305979296.pdfIn PDF document text
    • http://ainut.fi/userfiles/file/24911641665.pdfIn PDF document text
    • http://www.thaiboat.net/image/upload/File/55281009457.pdfIn PDF document text
    • http://www.nestroots.com/wp-content/plugins/super-forms/uploads/php/files/6auvla5bt0roh2engddk8kmnjo/wapikogobamudivi.pdfIn PDF document text
    • http://chonburi33.com/userfiles/file/20942235343.pdfIn PDF document text
    • https://idfusionllc.com/wp-content/plugins/super-forms/uploads/php/files/9ce0c9fb76551815b43ddc69d278ff8b/votuxe.pdfIn PDF document text
    • https://auto-rujo.com/images-editor/file/lotadigeta.pdfIn PDF document text
    • http://www.altrus.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1607effab0dc7b---liruv.pdfIn PDF document text
    • http://blevy.com/ckfinder/userfiles/files/regamumupolitifaj.pdfIn PDF document text
    • http://phone-server.com/userfiles/file/76416424662.pdfIn PDF document text
    • http://bizwd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160fbb0fde2ea9---1230773631.pdfIn PDF document text
    • https://www.criteriainvest.com.br/wp-content/plugins/super-forms/uploads/php/files/4qcamfqov8rhi8uk2pvf5rtb56/rajewan.pdfIn PDF document text
    • https://otdelkamos.ru/wp-content/plugins/super-forms/uploads/php/files/571bf18284e4279eb5471d3661f98478/7926248756.pdfIn PDF document text
    • http://3e-recycling.ru/app/webroot/filesfiles/rosulesibowufopa.pdfIn PDF document text
    • https://gfow.om/wp-content/plugins/super-forms/uploads/php/files/pl3js9jdho5iq1vp269temvlrh/95822464026.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd23.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD23 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000f535.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF535 16992 bytes
SHA-256: ac129327a567fe8c668b542028977ab016ef5485eb94fa2cddeee5f460f30853
font_02_sfnt_off0001208e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1208E 10660 bytes
SHA-256: de7ed94e37a09149e1ed878b0d8d1ab0a21bec620f2a85a69af56cc57ebc0e8d

Open this report in the interactive analyzer, or submit your own file for analysis.