Malicious PDF — malware analysis report

Static analysis result for SHA-256 5be9340c08278ed6…

MALICIOUS

PDF

71.3 KB Created: 2021-05-01 12:18:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-28
MD5: 9eb5bd6e6dad9a503a26c8e674656354 SHA-1: 69da85bbb3f57b45dd9289c6803f15df211f3a9b SHA-256: 5be9340c08278ed62d36c3f356c03db6cad14edfe1300e6bc737585e562867df
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm pointing to multiple compromised websites, likely intended to host malicious files. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a pattern of using disposable hosting for these links. The ML classifier also flagged this PDF as malicious with a high score.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8179

Heuristics 4

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.airportlimofortlauderdale.net/wp-content/plugins/formcraft/file-upload/server/content/files/1606ca49482646---gupewazibil.pdf In PDF document text
    • http://www.morenoroofing.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087b5bf69466---sazufezi.pdfIn PDF document text
    • https://siphouse96.com/wp-content/plugins/super-forms/uploads/php/files/c535d731d8d58b2ccf53dcc765613a0d/folajoduxokenexe.pdfIn PDF document text
    • https://maidintown.co.uk/wp-content/plugins/super-forms/uploads/php/files/5d7a07b8cee1f2caa173e417135fc23e/bamadizemizised.pdfIn PDF document text
    • https://victory-agency.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607fa40056e39---palixijovisotabibow.pdfIn PDF document text
    • https://www.mnspineandsport.com/wp-content/plugins/super-forms/uploads/php/files/a5f45d8b7eb8c564c1e0a0a5e2e51aad/67347496140.pdfIn PDF document text
    • http://es-umzuege-transporte.de/wp-content/plugins/super-forms/uploads/php/files/cea5346b666b119dbfaf9eba4f67f6b0/damilid.pdfIn PDF document text
    • https://www.getfitcrew.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606efd37d0db2---39789781298.pdfIn PDF document text
    • https://segurosjdd.com/wp-content/plugins/super-forms/uploads/php/files/6d58g3ghj0ma7hoggbr68l7gc2/ditubavubajizizovevigi.pdfIn PDF document text
    • http://rufullthrottle.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606dbc3bd0c2d---48006670211.pdfIn PDF document text
    • http://atlantichomeportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607593164ddb9---fepiva.pdfIn PDF document text
    • http://www.veronicaneal.com/wp-content/plugins/formcraft/file-upload/server/content/files/1/1607c5caff3fac---49836719063.pdfIn PDF document text
    • http://www.pirac.org/wp-content/plugins/super-forms/uploads/php/files/1fbe457ea53fe2daaf838c7680ef1cdc/53609739387.pdfIn PDF document text
    • https://www.ediliziaindustriale.com/wp-content/plugins/formcraft/file-upload/server/content/files/160845c1f04217---wobinufidatij.pdfIn PDF document text
    • https://dongytueduc.com/wp-content/plugins/super-forms/uploads/php/files/moclnpne1p9gt226m69sajjjou/28907646473.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=thesis+proposal+template+powerpointPDF link annotation
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107A0 5100 bytes
SHA-256: f4b2a5c9fa923581fee5debad9258e2b0d48129b777025c5da99c10ceb1d5677

Open this report in the interactive analyzer, or submit your own file for analysis.