Malicious PDF — malware analysis report

Static analysis result for SHA-256 65ada3d5d64b40ee…

MALICIOUS

PDF

86.8 KB Created: 2021-05-23 03:14:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7c1a3d457d7e571cab527055c90a79ab SHA-1: f801daa493bc613070df09b92fd94eb3e247e8bb SHA-256: 65ada3d5d64b40ee4862d5da09a95531b82c7398b0a062ba25d7e0af09395452
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links to compromised WordPress sites, suggesting it's part of a link farm designed to host malicious files. The ML classifier also flagged this PDF as malicious. While no scripts were directly extracted, the presence of embedded URLs and the heuristic firings indicate a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6894

Heuristics 3

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://stcatherine.ac.ug/wp-content/plugins/formcraft/file-upload/server/content/files/160a169d17e789---45653610559.pdf
    • https://www.jemelectric.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f95bda8a35---susojupuneterajag.pdf
    • http://www.pilonidalsinus.gen.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1606cb79c6df2d---45034634004.pdf
    • https://www.kbstephens.com/wp-content/plugins/super-forms/uploads/php/files/7b21901d8d37705972966ab5f96ae493/rasimudugudawewekuwef.pdf
    • http://fashioneducation.ru/userfiles/file/43494520076.pdf
    • https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/765uediuepj5jnv4u4rdbirhed/bebavuvo.pdf
    • https://action-roofing.com/wp-content/plugins/super-forms/uploads/php/files/f6a63f020d601613470135a391a282fc/12369876129.pdf
    • https://anandamsanyal.com/userfiles/file/21576760399.pdf
    • http://extreamtuning.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160793dc002d8f---retenivufogutavuwexojegas.pdf
    • https://ildiko-szepsegszalon.hu/userfiles/file/46270480634.pdf
    • http://www.prieteniitehnicii.ro/documente/file/22649035180.pdf
    • https://yellowstonewildlife.com/98737318787.pdf
    • http://cuatro-pr.org/sites/default/files/file/96442536799.pdf
    • https://tfnd.org/wp-content/plugins/super-forms/uploads/php/files/170052ba09829d87a68242d97bc0700f/26229417636.pdf
    • http://mko-yug.ru/wp-content/plugins/super-forms/uploads/php/files/e750cee955ef4119cf49cc9a8dea3861/71337057532.pdf
    • http://afghansolar.com/userfiles/file/mujegilevogizofuni.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/PmAiG5ZyT-k/uplcv?utm_term=fortnite+avengers+endgame+apk+download
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e010.bin
729c61919de10ed54502f7d5e40dca3786ff5e5af72f7e76705b696f7337f5b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE010 4864 bytes
font_01_sfnt_off0000f115.bin
159008cd4744195f740043f7a0c297b5ff304b14204dcc15f9e4fbe9aad3beaf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF115 5236 bytes
font_02_sfnt_off000102d8.bin
cd0f4459de52dfd6ad42251c6369362a9af6018fafeec65dcaeb8cee15515f08		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102D8 5812 bytes
font_03_sfnt_off0001116f.bin
b2f5bc3c63625e70d80137a2f259b789eb8de1a6b6fac49089bee5a25da270f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1116F 19356 bytes
font_04_sfnt_off00014432.bin
237e39fa64853773ae7fcffcda96ec0f29da6f109904ca3b11952de1d6455b08		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14432 16372 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.