Malicious PDF — malware analysis report

Static analysis result for SHA-256 60aacbd30e3f57b5…

MALICIOUS

PDF

129.0 KB Created: 2021-07-01 18:09:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: 499141a6c3fe63a8f5f538a947802eaa SHA-1: 4102906f0bc411e7b5003c168f7f2465621658e3 SHA-256: 60aacbd30e3f57b5dcfbc19f2affbcead021fe101d1b9c0b8dbefb0d72854271
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains a large number of embedded URLs, many of which point to compromised WordPress upload directories. The ML classifier strongly indicates maliciousness. The primary purpose appears to be a link farm, potentially for SEO manipulation or to distribute further malicious content, rather than a direct user-facing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/uplcv?utm_term=vba+copy+worksheet+to+another+worksheet PDF link annotation
    • https://www.espymetcalf.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab3699f2694---depepebipovuten.pdfIn PDF document text
    • http://www.radiopopiatej.com/wp-content/plugins/formcraft/file-upload/server/content/files/160829bde56474---dumajikupalagomiparajowog.pdfIn PDF document text
    • http://www.realisthotel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab56789a5e7---desugukusixufifarokiv.pdfIn PDF document text
    • http://score1forspencer.com/clients/4/45/4587145e2679cb7673d0e21b436e5c25/File/matifamitaditadesajubamur.pdfIn PDF document text
    • https://www.alapan.org/fckimages/file/99353624888.pdfIn PDF document text
    • https://www.vbclighting.com/wp-content/plugins/super-forms/uploads/php/files/b4c51a6f286c33547fd4c4130d10ee9f/xasijodopovewapaxojop.pdfIn PDF document text
    • https://sandalyecenneti.com/wp-content/plugins/super-forms/uploads/php/files/j5c9qv3f7mgj1lnn4qguem3mo2/genegisuxizopisu.pdfIn PDF document text
    • https://law.myvzl.com/wp-content/plugins/super-forms/uploads/php/files/jgb6bf2atlktl94n4m4bredb99/torizisipatele.pdfIn PDF document text
    • http://freemansphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d95ef3b438---vomopozowoxof.pdfIn PDF document text
    • http://aelma.com/sites/default/userfiles/file/fidemunagixadige.pdfIn PDF document text
    • https://www.beewellrx.com/wp-content/plugins/super-forms/uploads/php/files/tmp/5106070134.pdfIn PDF document text
    • http://bindashnews.com/userfiles/file/jobiga.pdfIn PDF document text
    • https://amirep.com/wp-content/plugins/super-forms/uploads/php/files/b115fbbe5bb93f8394161f9dcc4eb14a/98123789964.pdfIn PDF document text
    • http://evabody.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1606f2c92c181c---33635070209.pdfIn PDF document text
    • http://househouse.it/userfiles/files/vugarimofopokudomisu.pdfIn PDF document text
    • https://www.lightingdynamics.com/wp-content/plugins/super-forms/uploads/php/files/85e6eb8760e7cf4607c97fa11369a7a3/repufuvawutizupisodugo.pdfIn PDF document text
    • https://bonpetsupply.com/wp-content/plugins/formcraft/file-upload/server/content/files/160758f8c73370---bewebosotoxukafakefe.pdfIn PDF document text
    • https://opsclown.it/ckfinder/userfiles/files/bemiw.pdfIn PDF document text
    • https://ayurvedaemart.com/uploads/file/lazowonudekavelix.pdfIn PDF document text
    • http://www.unidacardoso.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609e3d40ef582---92239086177.pdfIn PDF document text
    • https://hsegroup.ru/wp-content/plugins/super-forms/uploads/php/files/ajts9bbe7k97l239pvrrlfrf60/dowogifuzuvurudibofof.pdfIn PDF document text
    • http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d58328840b---zugadepilodoximuve.pdfIn PDF document text
    • http://www.xpresswedding.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a2aec04a29c---nokusojumu.pdfIn PDF document text
    • http://www.trimbleexpress.sk/wp-content/plugins/formcraft/file-upload/server/content/files/160abdc40863d6---54502028577.pdfIn PDF document text
    • http://php-lounge.de/userfiles/file/42943737521.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000187f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x187F2 10732 bytes
SHA-256: 0cabe73ad3bd26b9a17cb72a765f07b1643e7a103044a89c5f14c5a7897440a6
font_01_sfnt_off0001a083.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A083 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0001b895.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B895 27764 bytes
SHA-256: 69e0698173454d07a1b060f42cedc16966574a8e576c90bd84eacdc1efcd3097

Open this report in the interactive analyzer, or submit your own file for analysis.