Malicious PDF — malware analysis report

Static analysis result for SHA-256 0600feaf93de71d4…

MALICIOUS

PDF

89.9 KB Created: 2021-06-26 01:18:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 3976826b2b70bbc70cfad01e8f7ec0c2 SHA-1: 2cebe6f4e1c080c5b82e999a5feb110e76bba0d3 SHA-256: 0600feaf93de71d4161fe99ef93f95ae6e6c5ec0be3f7a70407e5fb0747753de
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link farm pointing to multiple compromised WordPress sites, suggesting an attempt to host malicious content. The ML classifier strongly flagged this PDF as malicious, and the 'SE_CALLBACK_LURE' heuristic indicates a callback phishing or tech-support scam pattern. While no scripts were directly extracted, the structure and heuristics suggest the PDF is designed to redirect users to potentially malicious sites or to initiate a social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9946

Heuristics 6

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://na-nule.ru/wp-content/plugins/super-forms/uploads/php/files/u9dmp69eaqnhgrihte7i8lt3o3/zukiridil.pdf
    • https://wholisticvibrations.com/wp-content/plugins/super-forms/uploads/php/files/9b743f85a57366c6fe6425a228355572/bepewesag.pdf
    • https://qualitylightsolutions.com/wp-content/plugins/super-forms/uploads/php/files/262deab838ec721d8fd5846226054a75/91334554503.pdf
    • http://austria-ex.com/images/blog//file/komebawekexifagoni.pdf
    • https://dmddsgn.com/wp-content/plugins/super-forms/uploads/php/files/139b0452cd046c6bcbab6daac37d174e/weresok.pdf
    • https://www.adler-leitishofen.de/wp-content/plugins/formcraft/file-upload/server/content/files/160cb885ea98ef---18822487819.pdf
    • http://www.naturapreserved.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bdaf51b5c83---78508773259.pdf
    • http://veronicanealhome.com/wp-content/plugins/formcraft/file-upload/server/content/files/2/160c8e03007360---21714474235.pdf
    • https://apoc.com.au/wp-content/plugins/super-forms/uploads/php/files/dcf6e42564967e54d1143bb55c615516/39621304511.pdf
    • https://www.stamfordtaxis.com/wp-content/plugins/super-forms/uploads/php/files/b04jb5cmtpa92hod7mbftr36fq/robikivunewu.pdf
    • https://gservicepz.com/wp-content/plugins/super-forms/uploads/php/files/b9c3d093e93d3ca3614bd70ec32c2246/26930313830.pdf
    • https://expungemyrecordnj.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083215b22a09---91466548595.pdf
    • http://bergfin.se/wp-content/plugins/formcraft/file-upload/server/content/files/1608e58c5b6db1---46129513252.pdf
    • http://manixcnc.com/ckupload/files/37200746576.pdf
    • http://www.patricktennis.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1609c26ac472fa---tepowubudasozubobofavesi.pdf
    • https://luathoanghuy.com/uploads/files/puraditewamululonu.pdf
    • http://10glazsikeyrosa.ru/file/raxusigakirubadedaves.pdf
    • http://omonetach.pl/foto/ilustracje/file/valomivowek.pdf
    • https://pyhm.ca/wp-content/plugins/super-forms/uploads/php/files/76jk395h2cqqf2u8f21j9mjqbl/kivajex.pdf
    • https://www.3dreamchurch.com/wp-content/plugins/super-forms/uploads/php/files/2cbe278c9b58bfa0877fa66d7d031eb7/199305051.pdf
    • https://x-software.cz/data/file/6769219362.pdf
    • https://www.skyline-recruiting.com/wp-content/plugins/super-forms/uploads/php/files/ea552c20c3734aa253519a8d9fe06b6b/telabexo.pdf
    • https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=how+do+i+unblock+a+number
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7d3.bin
5602dca2374fe6cffe18bc1e6edda19c9c3d2d9598562ce0707b72f977b8ef1b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7D3 10672 bytes
font_01_sfnt_off00010031.bin
52f79b8c0c29509a94a9e7f354bb43cbe5297c2501a7bc94606db41651527a3f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10031 17044 bytes
font_02_sfnt_off00012cee.bin
dae5038d748b2b7d89173d83a61ff0ceefc2856cc76f3bb6f5837745f88f8889		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CEE 16084 bytes
font_03_sfnt_off0001421d.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1421D 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.