Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef7204fe32384796…

MALICIOUS

PDF

262.1 KB Created: 2021-07-22 11:59:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: e714aec65ab2697936641402a8a49e11 SHA-1: baf13891447af6f8dba4e3790cdf2c5ca98b9e43 SHA-256: ef7204fe32384796185919bed3422fb7e72d6a3d0fc4aa1d770f303fd2ab8d80
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as a malicious PDF by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links, including one pointing to a compromised WordPress upload directory, suggesting it's designed to redirect users to malicious sites. The presence of embedded URLs and the nature of the detection point towards a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9748

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://trungtamdaykem.vn/Images_upload/files/xaluzo.pdf In PDF document text
    • http://sharise.net/Uploadfiles/files/97009345740.pdfIn PDF document text
    • https://hmv.ir/wp-content/plugins/formcraft/file-upload/server/content/files/160ab8eb908037---pabajisuwumazalewag.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b0f1486aad9---44129142237.pdfIn PDF document text
    • https://www.tai.gr/wp-content/plugins/formcraft/file-upload/server/content/files/16070fbe323d87---nepirami.pdfIn PDF document text
    • http://xsteelstock.com/d/files/41232141110.pdfIn PDF document text
    • https://plentis.eu/ckfinder/userfiles/files/dodofakidoru.pdfIn PDF document text
    • https://canvasations.com/wp-content/plugins/super-forms/uploads/php/files/97dp416l8m90gdrun39qljbns3/89853663747.pdfIn PDF document text
    • http://linpus.com/app/webroot/userfiles/files/8144024818.pdfIn PDF document text
    • http://www.afamaresme.org/wp-content/plugins/formcraft/file-upload/server/content/files/16076212b959d4---xanomazidaluzejatutobawap.pdfIn PDF document text
    • https://terravistahometeam.com/wp-content/plugins/super-forms/uploads/php/files/098170f9395cee948c6943c5e13639c3/denenawen.pdfIn PDF document text
    • https://www.myjamaicais.com/wp-content/plugins/super-forms/uploads/php/files/30cfe6a68f9bb097c2de6642adb134a3/dizib.pdfIn PDF document text
    • http://sts-logistika.ru/wp-content/plugins/super-forms/uploads/php/files/55b2e1c04da40659976a275da90f2a91/gijerokujiz.pdfIn PDF document text
    • https://kes-stv.ru/wp-content/plugins/super-forms/uploads/php/files/08313fee58fd0e25f0dcc6b16b2afb37/sowepuwikitemegoguzifepo.pdfIn PDF document text
    • https://victory-agency.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609055eddddec---pidetibekanowofirukuxu.pdfIn PDF document text
    • http://abwplazaview.com/uploads/files/kiniwenovelusuvumapaj.pdfIn PDF document text
    • https://kodeac.com/wp-content/plugins/super-forms/uploads/php/files/apjhfn9kn2n4njl3ssvm67p48g/pufuloropemim.pdfIn PDF document text
    • https://www.areatransfers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160716a1347079---mudijerisogenet.pdfIn PDF document text
    • https://lightsourceindiana.com/wp-content/plugins/super-forms/uploads/php/files/ac7fdec11109e547d943b3473590a9da/33453686624.pdfIn PDF document text
    • http://artospace.com/pics/file/15423107782.pdfIn PDF document text
    • http://bjhtdszdh.com/v15/Upload/file/20216202229375290.pdfIn PDF document text
    • http://esthebel.de/userfiles/file/fukomobutozagumuxufawil.pdfIn PDF document text
    • https://sk-developers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160736b3fa0ca5---40619487336.pdfIn PDF document text
    • http://brooklynsmokeshops.com/admin/images/file/xejozoxe.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/GLLx1DTH0VQ/uplcv?utm_term=operating+manual+for+iphone+5sPDF link annotation
    • https://tes-sys.com/uploads/ckfinder/files/20210716/16264207799599.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003a9ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A9CE 11064 bytes
SHA-256: 93ccbb44b612f565db68cbb267a22f4755b04c263b57f56ec18ab41a06cf5da8
font_01_sfnt_off0003c36d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3C36D 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0003db7f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3DB7F 17636 bytes
SHA-256: 15baa0763f32d277951ca7c85d8ccd5334e7f52be03a51289966ab7d1fce67e1

Open this report in the interactive analyzer, or submit your own file for analysis.