Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5e7eb0dcc6cad74…

MALICIOUS

PDF

131.2 KB Created: 2021-06-09 20:33:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-24
MD5: 6811b66b0e31727651a714e959c7ae4e SHA-1: daab5e61fb94984fc0f315910f247a6059619047 SHA-256: f5e7eb0dcc6cad74a2bea5c381f06d910402c50803ec273ac25c44a378158375
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file exhibits characteristics of a phishing lure, employing a link farm hosted on multiple compromised websites and disposable domains to direct users to download potentially malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution. No scripts were extracted, but the PDF structure itself facilitates the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9848

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/uplcv?utm_term=2kids+in+a+sandbox+video PDF link annotation
    • https://ludifrance.fr/userfiles/file/givebasatikesasix.pdfIn PDF document text
    • http://www.alex-vasilkov.ru/images/wisdom/file/21989857627.pdfIn PDF document text
    • https://markzone.az/wp-content/plugins/super-forms/uploads/php/files/0ga6cti1uukb52kojg528482ma/50394313431.pdfIn PDF document text
    • http://pebyte.com/wp-content/plugins/super-forms/uploads/php/files/995pe4rup82p037oqm9a6q3d6k/81864894900.pdfIn PDF document text
    • http://argentum.com/wp-content/plugins/super-forms/uploads/php/files/jbqk87pkf7f0fpd9u3je31gtj2/82861415743.pdfIn PDF document text
    • https://www.rowtheerne.com/wp-content/plugins/super-forms/uploads/php/files/e7b70bed8a67b5a3fadc3c259eb92d7f/41121876832.pdfIn PDF document text
    • https://www.grandeprairie.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607fc59bbb27e---sibaxitubadup.pdfIn PDF document text
    • http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/1607d84312624b---tagitafeki.pdfIn PDF document text
    • https://www.getfitcrew.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d4d398a7c7---82919144614.pdfIn PDF document text
    • http://deurwater.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609ddb3765fdd---25141689732.pdfIn PDF document text
    • https://sketchup360.vn/wp-content/plugins/super-forms/uploads/php/files/6ffsnh0ej7np0f8c15i25luv6a/zabixifarukodokuxamido.pdfIn PDF document text
    • https://joepromenshealth.com/wp-content/plugins/super-forms/uploads/php/files/8ebbfd85e395467139740624fd3bf060/87760480500.pdfIn PDF document text
    • https://voolabs.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f7edac99a0---87406362995.pdfIn PDF document text
    • https://www.baptistenhardenberg.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608566c787731---fazevijetugetezuritepoxok.pdfIn PDF document text
    • https://baigiangtoanhoc.com/upload/files/41683537145.pdfIn PDF document text
    • http://blltly.com/1m2rwaIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00018cc0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18CC0 11680 bytes
SHA-256: d7343032266ac3f7bbbbbe765206b2f0be7b02ca26cbf06f2c509af1e109e8a0
font_00_sfnt_off000147c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x147C1 6744 bytes
SHA-256: b29f9350a720d2da9dc50567d08c4a82684db1fcb28a47e3a5788345b392d808
font_01_sfnt_off00015876.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15876 10652 bytes
SHA-256: 7c98ab1ab886120396d7d4bba6bf7530ae1f2272b4c0e124a77f71fbf1459dd1
font_02_sfnt_off00017b7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17B7D 5060 bytes
SHA-256: 3c540b0dac5f4683bdc66fcb638c35d5f6ef5a2fa9c928a04ca8a9e29e67af4e
font_04_sfnt_off0001ade9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1ADE9 13132 bytes
SHA-256: 5cb3556e2b88af7adbc1508f3876e2ad4b5be53700514d11517cd8b03e9f0ba0
font_05_sfnt_off0001d99a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1D99A 16864 bytes
SHA-256: 256e4b82e46ab897ee5bf8ffc904ec906ef27eb4697c6c37cd7263cfd9210fcb
font_06_sfnt_off0001f1ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F1AB 3040 bytes
SHA-256: 246c0fe02d557cf73e2e218972119104c540d7e4b0f964fdab2a352ea94f5d7f

Open this report in the interactive analyzer, or submit your own file for analysis.