Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b4f2451ffa83324…

MALICIOUS

PDF

87.9 KB Created: 2021-09-05 13:29:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: abb2e1d00ee7c176c33ffd873670b97d SHA-1: 32f4b5b442038af9ee6923c21d277017b34d154e SHA-256: 4b4f2451ffa833248f35da9f2044dc5745e70888352781296971dfbd46c461a5
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded URLs, many of which point to compromised websites or disposable domains, indicating a link farm designed to lure users to potentially malicious sites. The heuristic firings suggest the document is intentionally structured as a link farm, possibly for phishing or malware distribution. No scripts were extracted from this sample, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3510

Heuristics 4

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=formation+windev+22+pdf PDF link annotation
    • http://svsteinfurth.de/radsportfiles/file/21719920713.pdfIn PDF document text
    • https://razdolle.by/wp-content/plugins/super-forms/uploads/php/files/u6fhlt9irk5ru89gq5290ho767/86922498873.pdfIn PDF document text
    • https://www.kindspring.org/inc/ckfinder/userfiles/files/27153131510.pdfIn PDF document text
    • http://vtdsbinhthuan.vn/public/uploads/userfiles/file/bixopelozopadir.pdfIn PDF document text
    • http://duetsepolno.pl/userfiles/file/27685206574.pdfIn PDF document text
    • https://trisyscom.com/userfiles/file/texaloxanifomulup.pdfIn PDF document text
    • https://forssh.com/userfiles/file/2366089069.pdfIn PDF document text
    • https://avenirpourtous.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1607f1deb9538d---36768536152.pdfIn PDF document text
    • https://www.analfissur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d879f3377f---26265390042.pdfIn PDF document text
    • http://uniquecharacters.com/upload/files/paxanitozunoxep.pdfIn PDF document text
    • http://hnspkjx.com/d/files/kixatemularomajotoka.pdfIn PDF document text
    • http://abnicum.ru/files/file/60932248761.pdfIn PDF document text
    • https://agsposure.org/wp-content/plugins/super-forms/uploads/php/files/a6a77cff2954ef70ee048f88c84aa833/xiwugunekagazemelikat.pdfIn PDF document text
    • http://vendingchat.ru/uploads/ckfinder/files/jixejedibilukewowawujer.pdfIn PDF document text
    • https://eletroluz-al.com/_IMG/img_internas/file/riwuwumelemezetovejujom.pdfIn PDF document text
    • http://dangkyidol.com/wp-content/plugins/super-forms/uploads/php/files/3bcq1uevppr1q56fa4k8an7qoa/duxazokurigibute.pdfIn PDF document text
    • https://globalcircle.club/userfiles/file/48031311227.pdfIn PDF document text
    • https://canionglobal.com/FCKeditor/file/92988574080.pdfIn PDF document text
    • http://soeurs-scjboran.fr/soeurs/upload/files/minulofowisemefoxafepuru.pdfIn PDF document text
    • http://totalfinance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16132e12f2ba40---jitateleminevafopomesowe.pdfIn PDF document text
    • http://candybeauty.vn/upload/files/xilejapi.pdfIn PDF document text
    • http://perfectthesale.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb099fa776f---90912516501.pdfIn PDF document text
    • http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087fc919bd84---3740668386.pdfIn PDF document text
    • http://veterky.ru/ckfinder/userfiles/files/59671007251.pdfIn PDF document text
    • http://hotelclinton.it/userfiles/files/zaguro.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d74a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD74A 22508 bytes
SHA-256: 4748f5d4d7071ce8fc3981cf8f31df6b516f07387bd69713f4d8e04e927626cf
font_01_sfnt_off000111d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111D7 1684 bytes
SHA-256: 9c928bf144e3eec6b0e52ae2bba533670589b2228405e28e178bb89e049a64b1
font_02_sfnt_off000119ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x119CE 16388 bytes
SHA-256: ccf72b37f4042dd64bb67a2e5e961e22b551b7a8a6449ae0c89ac042836f922b
font_03_sfnt_off00013061.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13061 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_04_sfnt_off00014878.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14878 10692 bytes
SHA-256: a58d8de5eedefef7142477812fd681b455fdf936bf7a593cfed5e84f67cfb438