Malicious PDF — malware analysis report

Static analysis result for SHA-256 06bd674b8ef3e799…

MALICIOUS

PDF

72.0 KB Created: 2021-07-02 06:46:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 8ded3512b6db2e9853d5b70f623910a9 SHA-1: 1d379403560eae332f4088dc720c379fb538eeab SHA-256: 06bd674b8ef3e799d33cd7ce834879cddf114ec86025c684d2a2c65b136cb05a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a large number of external links, many of which point to compromised WordPress sites. The ML classifier strongly indicated maliciousness, and the heuristic firings suggest this PDF is part of a link farm designed to manipulate search engine rankings or distribute further malicious content. No scripts were extracted, but the structure and URL patterns are indicative of a malicious distribution or SEO poisoning campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9947

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://brokenspoke.com/wp-content/plugins/super-forms/uploads/php/files/9097761df00af0af8cd5085cc605bb99/4462378753.pdf
    • http://www.ebsjosepirosamaria.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a918eea2c40---mijubapubivamujapob.pdf
    • http://sns.hu/_user/file/mopubomazekixejomuviv.pdf
    • http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607158677a25b---80848644473.pdf
    • https://walkandsmile.com/userfiles/file/19736290008.pdf
    • http://hotelbellevuepalermo.com/userfiles/files/94407180383.pdf
    • http://shadesvalleymounties1969.com/clients/868959/File/zojovekez.pdf
    • https://www.simplythebestevents.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1608c893ec02e5---42068819691.pdf
    • http://www.photobreak.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b55daa09ac3---54604313260.pdf
    • http://joshuadacosta.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d017549628d---nexitexofizaxilujoginu.pdf
    • http://uniondeautoescuelas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083ab4cbd02f---xepelisomiburaxesanuwe.pdf
    • https://villatoscana-pi.it/userfiles/file/natoxebisuxisaponibaxo.pdf
    • http://meble-tk.pl/userfiles/file/42072166979.pdf
    • http://boathousebrokerage.com/userfiles/file/luleputinemu.pdf
    • http://dangkyidol.com/wp-content/plugins/super-forms/uploads/php/files/bgjc9rr7he7dsfgg6kvgj4c5tl/taxofewogumaxevagurixo.pdf
    • http://ofitecnic.es/files.ofitecnic/fck_up/file/68502843526.pdf
    • http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/b540d8ffaa426746f38a15bd260a306b/bomopovebarevuzatilikig.pdf
    • http://africanhairbraidingsalon.com/userfiles/file/24201408119.pdf
    • http://sciencevier.com/wp-content/plugins/formcraft/file-upload/server/content/files/160982a4da9d85---vumusokulabaredomogu.pdf
    • https://socialacademy.gr/wp-content/plugins/super-forms/uploads/php/files/c17b28cffa36ebb2dc52ce2aaf7f6bf5/88081084388.pdf
    • http://baschin-heizung.com/meineBilderAlbertGrundschule/file/nowusotemogo.pdf
    • https://europeancustomtailor.com/wp-content/plugins/super-forms/uploads/php/files/f546dec32664f2aae3cf439de88fb4a9/74566646958.pdf
    • https://www.cibaospalaser.com/wp-content/plugins/super-forms/uploads/php/files/krd3ko0ibldv222r28iobtlp05/tukumiju.pdf
    • http://www.trimbleexpress.sk/wp-content/plugins/formcraft/file-upload/server/content/files/160726be75843a---84688339013.pdf
    • https://messianic.live/wp-content/plugins/super-forms/uploads/php/files/c6ee7baf481489ef8120f3ca451d82f4/57883551623.pdf
    • https://feedproxy.google.com/~r/skout/mBVl/~3/1KS0DP0cxss/uplcv?utm_term=the+pearl+free
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bb9a.bin
dc9defce8f56dc2f123a3c9f39d78f502ce818b29cfc15215872b019557bb93c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBB9A 9836 bytes
font_01_sfnt_off0000d150.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD150 16792 bytes
font_02_sfnt_off0000e962.bin
231c00d161f9839606f4a40259a77b61f5f21e3f4bb3a408f54e64e295b7fc3a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE962 16024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.