Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ff1def3bc93ac9c…

MALICIOUS

PDF

61.6 KB Created: 2021-06-21 04:57:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: fb684bc54aba2c2018c48b1c096656ef SHA-1: aeb06ad19512d0506e413c8bbc912ca21fc89298 SHA-256: 1ff1def3bc93ac9c9c93dfdd927db1c54482cf316ee2aa061986e22a2579d25e
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded JavaScript and a link farm pointing to multiple disposable hosting domains, suggesting an attempt to redirect users to malicious content. The presence of a link farm on disposable hosting, combined with the ML classifier's high confidence, indicates a malicious intent to distribute further payloads or phish for information. The document body's metadata suggests it was generated by wkhtmltopdf, a tool often used to create PDFs from web content, which aligns with the link farm strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9406

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://midel.me/userfiles/file/bizor.pdf In PDF document text
    • http://cutencuddlybreedables.com/_images/file/99899633149.pdfIn PDF document text
    • https://dedywiredja.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c5d4f21ea96---fatomenemaserojowapefozu.pdfIn PDF document text
    • https://eletvital.hu/uploads/files/28024434883.pdfIn PDF document text
    • http://hiace-yoshikawa.com/js/upload/files/kawilebiporexamisek.pdfIn PDF document text
    • http://matstravel.ru/userfiles/file/83746882641.pdfIn PDF document text
    • https://www.traveltimevipp.com/wp-content/plugins/super-forms/uploads/php/files/9837fc5575e344686fffc2eebcddb386/pogepu.pdfIn PDF document text
    • https://egyiksem.hu/uploads/file/91790710080.pdfIn PDF document text
    • https://roeveragri.ac.in/wp-content/plugins/super-forms/uploads/php/files/13a43f3c157301b17834c6bbde1bd376/niziribipomenob.pdfIn PDF document text
    • http://mfcwestenkwartier.nl/beta/userfiles/file/juxumisel.pdfIn PDF document text
    • http://el-master.ru/userfiles/file/fapufuzagekobilexejuj.pdfIn PDF document text
    • https://stpetejazz.com/wp-content/plugins/super-forms/uploads/php/files/ob9j0ahljepjkfh90k6cng6eqd/koxurutu.pdfIn PDF document text
    • https://oiweld.com/wp-content/plugins/super-forms/uploads/php/files/f2cb54d9bf2cf715081e487166b9478f/74506601956.pdfIn PDF document text
    • http://alfavs.eu/userfiles/file/kaluginomefox.pdfIn PDF document text
    • http://www.hotel-margherita.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083b1498b8ea---28231525840.pdfIn PDF document text
    • http://angelcabrera.com/FCKfiles/file/wodozunedidub.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/cv9VXjIrmdE/uplcv?utm_term=attack+on+titan+2+movie+downloadPDF link annotation
    • http://s292376414.onlinehome.fr/datas/imgmail/file/lomewizofewogikejuji.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bbfd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBBFD 6148 bytes
SHA-256: 2e5571b870ce02d9e866bceea8169d7d776191c337755ff06386978f5ccbeb72
font_01_sfnt_off0000d14b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD14B 5148 bytes
SHA-256: 0a49290020fc1840e688c0a131e19882a22abd351cbbbcf154c6711fc162a2a7

Open this report in the interactive analyzer, or submit your own file for analysis.