Malicious PDF — malware analysis report

Static analysis result for SHA-256 f18b89d33c2c913e…

MALICIOUS

PDF

246.5 KB Created: 2021-07-28 03:32:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 0f37f1fccfd64e2d3d73cbc9c435965b SHA-1: b2572ab130bb1654e7a547277a814795b88f613d SHA-256: f18b89d33c2c913ea957226497b9d8fce7833cc64c0d68d986066e1a5ab5834d
166 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains heuristics indicating it is part of an advance-fee scam, specifically a lottery or parcel delivery lure. Multiple URLs point to compromised WordPress sites hosting PDF files, suggesting a distribution mechanism for this scam. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9877

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.cocochan.com.pk/wp-content/plugins/super-forms/uploads/php/files/a035af61001145dff1d307bde7916e89/pazukavelagopapelul.pdf
    • https://bellevuecommunityfoodbank.org/wp-content/plugins/super-forms/uploads/php/files/92b0f3e333db24191d3589b7ba63be10/85686045270.pdf
    • http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/160e447af2c096---1343295224.pdf
    • http://moreit.ch/productinfo/file/nuwavonebefobutimi.pdf
    • http://www.chinahkcarplate.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e1910b3a6b9---24700619351.pdf
    • https://pankalconstructora.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b1bc311157---lipovafiguk.pdf
    • http://absolutelyneon.com/userfiles/file/70525979963.pdf
    • http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cfd279c87c---nofagamanidevamagu.pdf
    • https://lescourailleurs.com/upload/editor/file/webolonozasuzufum.pdf
    • http://sacoorhealth.pt/site/upload/file/51126651807.pdf
    • https://festivalecolo.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607c551b8600d---46274316323.pdf
    • https://pikewallis.no/wp-content/plugins/formcraft/file-upload/server/content/files/160bbecf5ecac9---pafilosupexil.pdf
    • https://www.drserapkagan.com/wp-content/plugins/super-forms/uploads/php/files/ih1g0ua4skpphoamkv2bn3fuom/xigipezodisifudov.pdf
    • http://transinfosoft.com/userfiles/file/zoluguviwokifanelufozipib.pdf
    • https://www.bouldersudbury.org/wp-content/plugins/formcraft/file-upload/server/content/files/160be27bb67467---85211340310.pdf
    • https://burgas-remonti.com/userfiles/file/gomawofuwa.pdf
    • http://messtores.ca/fck_user_files/file/xagogu.pdf
    • http://akvatoria.by/UserFiles/files/90212837348.pdf
    • https://hmv.ir/wp-content/plugins/formcraft/file-upload/server/content/files/160870a923dbf2---muxib.pdf
    • http://sh8ke.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079755dc69e4---vubamuvovudefude.pdf
    • http://klefmarken.se/upload/file/jetefope.pdf
    • https://thaiwoodengames.com/files/upload/files/seferupegala.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=did+anyone+die+in+the+lynyrd+skynyrd+plane+crash
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00035cdd.bin
72e0852573666dde99f7de691355a88c92c3e8914a8d1db1ce727472a5cb6827		 pdf-font-stream PDF embedded font (sfnt) at offset 0x35CDD 10820 bytes
font_01_sfnt_off000375c1.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x375C1 16792 bytes
font_02_sfnt_off00038dd3.bin
5f165202b428d53670593569f02894cc43d42418c8e1dacc9304c70389bf1886		 pdf-font-stream PDF embedded font (sfnt) at offset 0x38DD3 24876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.