Malicious PDF — malware analysis report

Static analysis result for SHA-256 fcf72b226b509158…

MALICIOUS

PDF

337.3 KB Created: 2021-06-21 18:14:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: a3c69d13cfe36902ff9a6e4b837a4fec SHA-1: d4960bc4933eec53133d0c0eed9b32e98d7f1648 SHA-256: fcf72b226b5091588a43c6a1bd1bb6290613da5b371b857b9ead0d0a07fca6c4
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by multiple heuristics and an ML classifier as malicious, specifically as a phishing or trojan delivery mechanism. It contains numerous links to compromised websites, including one that appears to be a link farm hosted on a compromised WordPress upload directory. The document body, though heavily obfuscated, contains references to 'Vishnu purana pdf' and 'wkhtmltopdf', suggesting a lure to download or view content from a malicious URL. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9846

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/uplcv?utm_term=vishnu+purana+pdf PDF link annotation
    • http://com123.vn/uploads/file/fubalibaxonolinakolun.pdfIn PDF document text
    • http://www.caribbeandentist.com/wp-content/plugins/formcraft/file-upload/server/content/files/160892adaeaee6---30107737067.pdfIn PDF document text
    • https://mariellatriolo.it/public/file/67752473106.pdfIn PDF document text
    • https://www.justgym.co.za/wp-content/plugins/super-forms/uploads/php/files/nfc9hn05a2obsbt12ci7c9aakq/13328829603.pdfIn PDF document text
    • https://christembassybarking.org/wp-content/plugins/super-forms/uploads/php/files/40c0ea9e28e3bb8d39bce608c4dbb346/pajuza.pdfIn PDF document text
    • http://abnicum.com/files/file/fuvadeludorurupakiwaset.pdfIn PDF document text
    • http://thm-holding.ru/wp-content/plugins/super-forms/uploads/php/files/151367145de09ae843e7b9fa5b947204/ronanubolarotunedojoxuve.pdfIn PDF document text
    • https://stewsites.com/wp-content/plugins/super-forms/uploads/php/files/e6745d21b98e7ce7859d98ef6c7f1342/85508343302.pdfIn PDF document text
    • https://forex-robo.org/wp-content/plugins/super-forms/uploads/php/files/54b597ff9b7e14502e0540ac6609fcb1/simuxiruzexufijikutapu.pdfIn PDF document text
    • http://zelene-centrum.cz/webpagebuilder/ckfinder/userfiles/files/favarilaj.pdfIn PDF document text
    • http://klpa.net/userData/board/file/nelimixa.pdfIn PDF document text
    • https://interesttour.com/wp-content/plugins/super-forms/uploads/php/files/1c5b7d8f3cd598cd0483111ebe39cf45/vomomokefigolozunuz.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160be62d8ee810---wosavenelugivinigabobida.pdfIn PDF document text
    • https://tehnol.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160af949fa34de---nujepotumelupuzaj.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004f46d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4F46D 4636 bytes
SHA-256: a3c1e6d8a6efd8a03e7c5601a340483735bdc36e3e6465b2dda7262b798bab54
font_01_sfnt_off00050403.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x50403 10684 bytes
SHA-256: 2279ade4915fc199c57e625a73107fcdd657eb7d08125b8b6dc5d8f95f9e3d46
font_02_sfnt_off0005283b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5283B 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.