Malicious PDF — malware analysis report

Static analysis result for SHA-256 505af954fac615ec…

MALICIOUS

PDF

84.9 KB Created: 2021-08-26 04:35:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: ffe577f5a5cb526c37a4df7a1efc0539 SHA-1: 50cbf564374554c519628ceb4b1d2ae986b1612f SHA-256: 505af954fac615ecaf7d224c19999cd4237af6f52885a0514d7d5a101c4b5089
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of links pointing to compromised WordPress sites, indicating a link farm designed to redirect users to potentially malicious content. The ML classifier strongly flagged this PDF as malicious, and the presence of multiple distinct hosts hosting PDF files suggests a coordinated effort to distribute harmful content. No scripts were extracted, but the overall structure points to a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://paloaltospeakerseries.com/wp-content/plugins/super-forms/uploads/php/files/6b1a98ea0de134c4d7a1ae09aabb9bee/63074767361.pdf In PDF document text
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098defe093ae---89141920809.pdfIn PDF document text
    • https://ethiquedevelopers.com/wp-content/plugins/super-forms/uploads/php/files/306ee262bb41c1b686b01c0506c29969/90569891197.pdfIn PDF document text
    • https://stayatrosetta.com/wp-content/plugins/super-forms/uploads/php/files/1i82pjn1mi1updao0slcmh7m8p/zunadopamugixabovatok.pdfIn PDF document text
    • http://sure2trips.com/bot/ckfinder/uf/files/nomonotazenom.pdfIn PDF document text
    • https://travolution.travel/wp-content/plugins/super-forms/uploads/php/files/c639d82dfe452b566e2ced1fa3f1b3db/4372698292.pdfIn PDF document text
    • https://drahmetbostanci.com/wp-content/plugins/formcraft/file-upload/server/content/files/16074fccff1e71---23475712066.pdfIn PDF document text
    • http://lucavolpicella.it/userfiles/files/25514918699.pdfIn PDF document text
    • https://ecoinkworld.com/wp-content/plugins/super-forms/uploads/php/files/58fbfc7469512fdb2e7f773540195f06/92371987604.pdfIn PDF document text
    • https://bonpetsupply.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b7d341f3c9---vogitoferujosawotama.pdfIn PDF document text
    • http://cafesezony.ru/fck_editor_files/files/teduropiwunugodivopikatan.pdfIn PDF document text
    • http://szakkepzosiklos.hu/upload/file/31531645077.pdfIn PDF document text
    • https://bobecoingatlan.com/uploads/editor/file/49303847453.pdfIn PDF document text
    • https://deewo.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a84199e621a---67191563147.pdfIn PDF document text
    • https://kaimano.it/file/27979408688.pdfIn PDF document text
    • http://www.predoisiasociatii.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160a9ad0cc87cd---lifawibasovosew.pdfIn PDF document text
    • https://swimproject.eu/wp-content/plugins/super-forms/uploads/php/files/e4927dc3c53ecc1d53e667ecc332a6c4/27955342364.pdfIn PDF document text
    • http://ildungrice.com/fileupload/fckeditor/file/64500790953.pdfIn PDF document text
    • https://mamproducciones.es/wp-content/plugins/formcraft/file-upload/server/content/files/160b9606f2eb2b---51748455764.pdfIn PDF document text
    • https://paardenwelzijnscheck.nl/app/webroot/files/ckeditor_files/files/filol.pdfIn PDF document text
    • http://structurecreative.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cee8af04a27---35208642207.pdfIn PDF document text
    • http://cageart.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607faa7765a8e---14020052249.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/cv9VXjIrmdE/uplcv?utm_term=expression+for+second+order+reactionPDF link annotation
    • http://lovewhereyoulv.wpengine.com/wp-content/plugins/super-forms/uploads/php/files/11355527a4336b0fa7fe946d3e6539f3/83957523706.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e710.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE710 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000ff27.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF27 10652 bytes
SHA-256: bdbb0291b54d6ecf698d66c3fac3745ff9dcfdb725fd1fffc8d5103cc82c7394
font_02_sfnt_off000117af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x117AF 17292 bytes
SHA-256: 9ff03bae570558fb553509e03740c644b36f95a7faeabaec9268f0a18eaadb6c

Open this report in the interactive analyzer, or submit your own file for analysis.