Malicious PDF — malware analysis report

Static analysis result for SHA-256 065a25077484b047…

MALICIOUS

PDF

85.3 KB Created: 2021-09-22 14:00:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-21
MD5: fd9169f2223718d40d672de14bed5909 SHA-1: 6b892692e5c3295c3cc887d1a00a549e3073f6f3 SHA-256: 065a25077484b0478cd6fa71fd574400811c6792beb5f3224e4e5bee8946a360
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous links, many pointing to compromised CMS upload directories, suggesting it's part of a link farm or SEO manipulation scheme. The ML classifier strongly indicated maliciousness, and the presence of multiple external URIs supports a pattern of directing users to potentially harmful or misleading content. No scripts were extracted, but the overall structure and heuristic firings point to a malicious document designed to lure users to external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://carcarnet.com/home/sandbox/domains/hkdance.tritek.hk/public_html/ckfinder/userfiles/files/26781254417.pdf In PDF document text
    • http://wgadget.com/file_media/file_image/file/35506679804.pdfIn PDF document text
    • https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/161416f59650aa---bavanenap.pdfIn PDF document text
    • https://fiscalonline.eu/app/webroot/files/userfiles/files/xugodamupisigogam.pdfIn PDF document text
    • http://fiumevivo.it/userfiles/files/90363910298.pdfIn PDF document text
    • http://www.1atlanticfunding.com/wp-content/plugins/formcraft/file-upload/server/content/files/16143946ead099---punaxebatoxaxafuzoruturoj.pdfIn PDF document text
    • https://www.vibrationmonitoring.asia/wp-content/plugins/formcraft/file-upload/server/content/files/16140699bd0054---82643251518.pdfIn PDF document text
    • http://onlinevay.com/upload/files/xurapukex.pdfIn PDF document text
    • https://heatingboiler.ca/fck_upload/file/lapodomuzuretimo.pdfIn PDF document text
    • http://dallapietamarchisio.it/userfiles/files/96746103105.pdfIn PDF document text
    • https://studio45.live/wp-content/plugins/super-forms/uploads/php/files/hajrgt1iikc3o6vq3haimr2pvi/kagafi.pdfIn PDF document text
    • http://dd-eng.com/files/files/17418967882.pdfIn PDF document text
    • https://tdemo.order-pro.com/ckfinder/userfiles/files/girujawotifunumaz.pdfIn PDF document text
    • http://moiarchitekci.pl/pliki/file/peweboxo.pdfIn PDF document text
    • https://www.habitat-morvan.fr/ckfinder/userfiles/files/mijuzulirejigu.pdfIn PDF document text
    • https://bentzendesign.se/wp-content/plugins/formcraft/file-upload/server/content/files/1612fff959b4b3---29706162003.pdfIn PDF document text
    • http://jkbprivateiti.com/userfiles/file/fijodoj.pdfIn PDF document text
    • https://thesmithgrouphouston.com/wp-content/plugins/super-forms/uploads/php/files/a2abdc7aeb0dd5d90bfd3f81f8652de2/vexited.pdfIn PDF document text
    • http://hidropro.hu/upload/lakavixuxosobubuvowarasi.pdfIn PDF document text
    • https://pchome.uzai.ca/upload/files/wilifajatifofediwanena.pdfIn PDF document text
    • http://www.scea.edu.mn/ckfinder/userfiles/files/malodujoduzazabamepenej.pdfIn PDF document text
    • https://qpshouse.com/upload/image/file/68590805110.pdfIn PDF document text
    • https://reviewz.eu/app/webroot/files/userfiles/files/73698675458.pdfIn PDF document text
    • http://bienchidan.org/uploads/files/54556452025.pdfIn PDF document text
    • https://silverstonedevelopments.com/ckfinder/userfiles/files/11400403937.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=best+free+movie+sites+like+123moviesPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d181.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD181 17828 bytes
SHA-256: afde470e6ac05241d8b69f3a8e2999f119d25bb21020f77d07bb4ada4754b032
font_01_sfnt_off0000ec5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC5C 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00010473.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10473 10664 bytes
SHA-256: d4d999e65de937934d1760e29aa5f8fb705a1f2d89c782e8b2ed4d67e94e8cee
font_03_sfnt_off00011d13.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D13 16300 bytes
SHA-256: f8f21d38a5eaae09f15f54fcfddf0e400fe56639c40c6e2dd2410c20eb944408

Open this report in the interactive analyzer, or submit your own file for analysis.