Malicious PDF — malware analysis report

Static analysis result for SHA-256 5396b8e46109d1ce…

MALICIOUS

PDF

109.7 KB Created: 2021-06-20 09:33:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 451fd12cfca863dd0ed4980c003326a3 SHA-1: c70c3bcc9859e1e67759ac19da813a67e280f532 SHA-256: 5396b8e46109d1ce38517660b3a5bd2c17248115fb3365c78672d54c0aa8a08d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous links pointing to compromised WordPress upload directories and other disposable hosting sites, suggesting it functions as a link farm to distribute malicious content. The ML classifier strongly flagged this PDF as malicious, and the presence of multiple PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM and PDF_SEO_DISPOSABLE_LINK_FARM heuristics further supports its malicious intent. The document body, though heavily obfuscated, appears to be a lure related to TV show subtitles, likely to trick users into clicking the embedded malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://portalcom-b2b.es/img/user///file/_0479336001620082967.pdf In PDF document text
    • https://chicagoportablexray.com/wp-content/plugins/formcraft/file-upload/server/content/files/160acf1ad9fa98---86421137612.pdfIn PDF document text
    • https://www.davinci.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160a91b0e8e419---11850249373.pdfIn PDF document text
    • https://freedomhypnosisnyc.com/wp-content/plugins/super-forms/uploads/php/files/af262bdae0bffb0484702520263f92f4/1474725327.pdfIn PDF document text
    • https://otartufo.com/ckfinder/tartufofiles/files/82313838081.pdfIn PDF document text
    • http://www.opencalgary.org/wp-content/plugins/formcraft/file-upload/server/content/files/160ace32b69115---97398792336.pdfIn PDF document text
    • http://kystop.com/wp-content/plugins/super-forms/uploads/php/files/8idfb8e3otrge3pk7li0n2tbg3/jirinuf.pdfIn PDF document text
    • https://bringem.de/wp-content/plugins/super-forms/uploads/php/files/c4c5ad1fbce1a9c11e64c6e485da2196/kijepivirabunuwewiteliju.pdfIn PDF document text
    • http://www.iqubz.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab5e63d6dfe---tilolozukegasuvexor.pdfIn PDF document text
    • https://www.federatedlighting.com/wp-content/plugins/super-forms/uploads/php/files/2e693ea0056977052e95f4f8244a0382/15311984844.pdfIn PDF document text
    • http://gostium.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c406784ae15---ginivitamoxa.pdfIn PDF document text
    • https://uleshuzataruhaz.hu/files/file/30191366258.pdfIn PDF document text
    • https://www.energetisch-therapeut-estie.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a304fcdd142---95102345947.pdfIn PDF document text
    • https://anmimar.com/royal/userfiles/file/47526998832.pdfIn PDF document text
    • http://kinel-hunter.ru/upfiles/file/83470785107.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=my+love+from+the+star+episode+5+subtitle+indonesiaPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012de4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12DE4 5584 bytes
SHA-256: 2652441b3004fcaf8256ede187b021a44b3a6581d7d0959f1e623277381c5d5a
font_01_sfnt_off000140db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x140DB 5712 bytes
SHA-256: 506872d8ca8416d88b661243c45aef5094aa8403758cc87e21eea3249f984c8b
font_02_sfnt_off0001542a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1542A 7760 bytes
SHA-256: 5fb33f78492cc20e0d603d915ab45c69d79b3e586fb7839c7991c714680a6163
font_03_sfnt_off000169a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x169A1 12140 bytes
SHA-256: 849ad4662e913adfbca3fd4949cee963041b17277a80b553982e625da0708603
font_04_sfnt_off0001915e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1915E 16092 bytes
SHA-256: e9fe716c2abc985b12a899a49d5539e4e8be1b56d50c083b30290d85a2a7c848

Open this report in the interactive analyzer, or submit your own file for analysis.