Malicious PDF — malware analysis report

Static analysis result for SHA-256 6596e85b7286d006…

MALICIOUS

PDF

98.3 KB Created: 2021-08-17 12:22:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: a42d104eff949a2ecd6bcdd4edbdf539 SHA-1: 9e4c0b7c0601b3d6d7033f67b17de7cd85abc8d4 SHA-256: 6596e85b7286d006929690141bb4260931bcee1a0acc5e4f33e9b197cbdffd66
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a link farm with numerous URLs pointing to compromised WordPress sites, as indicated by the 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM' heuristics. The ML classifier also flagged this PDF as malicious with high confidence. These links likely serve as a lure to redirect users to malicious content, potentially for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jedzenie365.pl/ckfinder/userfiles/files/66186023073.pdf In PDF document text
    • https://glowskincare.net/wp-content/plugins/super-forms/uploads/php/files/7149945e83a8c2b984db76a244f89b3d/65519154344.pdfIn PDF document text
    • https://refundsrefunds.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c731dc8e2b---86626276296.pdfIn PDF document text
    • http://sluchatka-shop.cz/files/upload/files/liluzizimenogesekovo.pdfIn PDF document text
    • http://associacaoguainumbi.org.br/wp/wp-content/plugins/formcraft/file-upload/server/content/files/16071f841b81d5---60260369159.pdfIn PDF document text
    • http://www.marcelasemper.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c002ac6b5c1---zovawojuborasupobe.pdfIn PDF document text
    • https://neoville.ru/wp-content/plugins/super-forms/uploads/php/files/e049a0e11da00a99f548036b8ab768e7/wozewamu.pdfIn PDF document text
    • http://beetsom.com/PROGRAM_FCKeditor_UserFiles/file/945825291610dda677b3f3.pdfIn PDF document text
    • http://adveotec.com/img/file/gixijamo.pdfIn PDF document text
    • https://www.ccps.mx/wp-content/plugins/super-forms/uploads/php/files/7a92d6aaaedc2f3e8469fba5238907be/wugoxesutalopurukafe.pdfIn PDF document text
    • https://auf.vn/wp-content/plugins/super-forms/uploads/php/files/acppe1cunvf26s6tkhvqc4erl5/84147190747.pdfIn PDF document text
    • http://starke.ca/clients/84205/File/36963553559.pdfIn PDF document text
    • http://www.satit.nrru.ac.th/satit/_Adminis/ckfinder/userfiles/files/82476097167.pdfIn PDF document text
    • https://proff-doors.ru/wp-content/plugins/super-forms/uploads/php/files/aa0362b5bb4c97b0113cc8685566b542/webiziwiranaduz.pdfIn PDF document text
    • https://cortopolis.ar/userfiles/file/tomerox.pdfIn PDF document text
    • https://ontime-taxi.kg/wp-content/plugins/super-forms/uploads/php/files/356d0fe416bedae5d2b566d9130b51bd/72217425251.pdfIn PDF document text
    • https://www.inter-tube.co.uk/wp-content/plugins/super-forms/uploads/php/files/1984afa8f84bf008ea1deb0dddbbc70a/91546052411.pdfIn PDF document text
    • https://vernadoc.com/wp-content/plugins/super-forms/uploads/php/files/42ad80fb4fb2f80556866c66e368696c/69894307604.pdfIn PDF document text
    • https://lcd96.ru/wp-content/plugins/super-forms/uploads/php/files/c87052aeb7362b3902ef0aa25068529f/73156502601.pdfIn PDF document text
    • https://retake.dk/ckfinder/userfiles/files/paxukizuvunagazas.pdfIn PDF document text
    • http://solarhomepage.ch/fckeditor/editor/images/file/19137162804.pdfIn PDF document text
    • http://africansafaris-spain.com/FCKeditor/editor/filemanager/connectors/php/connector.php?Command=FileUpload&Type=File&CurrentFolder=%2Ffile/32382624603.pdfIn PDF document text
    • http://anhuizhkj.com/upload_fck/file/2021-6-28/20210628055356623042.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BvfzZFkJO3s/uplcv?utm_term=does+frankenstein%27s+monster+kill+victorPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011c9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C9E 18260 bytes
SHA-256: b70062df25f7d2d78f7a27f9ce5ba9f4f7d895642949c53c72ac25ab07eae634
font_01_sfnt_off00014a88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14A88 10692 bytes
SHA-256: dbb3288ce898243b7c33b8dd8164a6914db3f49db4efe93ad9c682f15eba084f
font_02_sfnt_off00016321.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16321 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.