Malicious PDF — malware analysis report

Static analysis result for SHA-256 72e32e80cc5e83b3…

MALICIOUS

PDF

101.1 KB Created: 2021-07-02 06:07:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: f6ab28fd41f9acf5d701cf1fec5a7b31 SHA-1: 58641450bc7c135b0d3886617a5e182f19ec89c0 SHA-256: 72e32e80cc5e83b3a2494344e3cf20bf7745a1541ce539f39260b262df53d18d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, many of which point to compromised WordPress sites. The ML classifier strongly indicates maliciousness, and the heuristic firings suggest this is a link farm designed to redirect users. The primary purpose appears to be SEO manipulation or hosting malicious redirects, rather than direct execution of a payload from the PDF itself.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9929

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nikken-engineer.jp/export/sd205/www/jp/r/e/gmoserver/8/6/sd0748886/nikken-engineer.jp/fckeditor/upload/file/45201831594.pdf In PDF document text
    • http://www.webtony.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609f980dd9084---77038833469.pdfIn PDF document text
    • http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/i8lq6dckofamu51s6b3hal2v00/luzomipulaz.pdfIn PDF document text
    • https://dintek.eu/uploads/file/mobovowujegi.pdfIn PDF document text
    • https://www.cedicar.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb5d9abf1fb---49684078786.pdfIn PDF document text
    • https://maturana.cl/upload/file/vuxibakag.pdfIn PDF document text
    • http://thedewakohchang.com/image/upload/File/ufujimawademokogowiwiwo.pdfIn PDF document text
    • https://xn--78-6kce7dfhb9dwb.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/dc74e31d1730f1aecd254d74f5f8c562/wifewegebitidafutatudepal.pdfIn PDF document text
    • http://lichnyiybrand.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160c0088459ce1---datufezutupawivesene.pdfIn PDF document text
    • https://www.nosolodespedidas.es/wp-content/plugins/formcraft/file-upload/server/content/files/160763fbd5531e---50385231644.pdfIn PDF document text
    • http://www.britocunhaadvocacia.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/160a457b9532e2---fuzusisotajeruravarejom.pdfIn PDF document text
    • https://misionesmedellin2030.com/wp-content/plugins/super-forms/uploads/php/files/rqjb4bg4q2rha5tkbsprdi31k6/28963226308.pdfIn PDF document text
    • https://n95america.com/wp-content/plugins/super-forms/uploads/php/files/d835bac19f6942259017bec9c85af6bb/rudedow.pdfIn PDF document text
    • http://www.hptindia.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609119f236529---40792482749.pdfIn PDF document text
    • http://novaserv.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4ba8635ae9---zukefutetapexogo.pdfIn PDF document text
    • https://adtw1.com/ckfinder/userfiles/files/gilizumovovivo.pdfIn PDF document text
    • https://him-home.ru/wp-content/plugins/super-forms/uploads/php/files/9b2f5a76bd7efef0fbb8eca9b390b7b8/benujedizegol.pdfIn PDF document text
    • http://dirabrealtors.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f1d8aa4908---vujomowenefisomuf.pdfIn PDF document text
    • http://ride.hu/images/uploads/files/64202448079.pdfIn PDF document text
    • https://ballestermultiservicios.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a8ecb76b947---mopuvopeju.pdfIn PDF document text
    • https://onelineservice.it/file/suwixukewedafunaxofeje.pdfIn PDF document text
    • https://forex-robo.org/wp-content/plugins/super-forms/uploads/php/files/3f52039c0e691e97c260543653dfb74e/22442152350.pdfIn PDF document text
    • http://euroear.eu/ckfinder/userfiles/files/rezefepinuti.pdfIn PDF document text
    • http://www.garriagricola.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cd3f91bef3---35507617707.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/fzgW7-mxBc0/uplcv?utm_term=photosynthesis+dark+and+light+reactionPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000126c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126C8 17628 bytes
SHA-256: f30697b8f63b158e3f49ce1f859a867942ea0ec537a646049909478cc4b1311b
font_01_sfnt_off0001543f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1543F 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00016c56.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16C56 10856 bytes
SHA-256: 8290b93164235f9bf1bc7213e36b3ffd6b4d81369eacf86883e28424bb582615

Open this report in the interactive analyzer, or submit your own file for analysis.