PDF malware analysis — malicious · 761407bba907575a

MALICIOUS

PDF

86.2 KB Created: 2021-07-07 17:01:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25

MD5: 250f513bd1de0d9e99213bd11fe50483 SHA-1: 42a42cabae955b80f2fb6c8cff3a5133dbdda52a SHA-256: 761407bba907575aba8bcdd041a8cba38a04c6afa0c6ea53b9c1e14940e076fe

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains a link farm pointing to numerous compromised websites, many of which host other PDF files. These secondary PDFs are likely malicious, serving as a lure for further exploitation or malware delivery. The ML classifier strongly indicated maliciousness, and the heuristics confirm the presence of a link farm on disposable hosting.

Machine Learning

Nyx PDF Classifier malicious score 0.9922

Heuristics 5

PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://realwebguys.com/wp-content/plugins/formcraft/file-upload/server/content/files/160872b549cef3---90994368443.pdf In PDF document text
- http://nd-58.ru/wp-content/plugins/super-forms/uploads/php/files/4e02bee25bc0f84da7bfbf4d4ec4f3d7/97317266469.pdfIn PDF document text
- http://redwoodpwr.com/wp-content/plugins/super-forms/uploads/php/files/urdku41craeie7rq133hl6unk6/94768102761.pdfIn PDF document text
- http://pvsystreports.com/wp-content/plugins/super-forms/uploads/php/files/1k4u2ltghpa3pdeot07vg9drt4/8158615782.pdfIn PDF document text
- http://konyaozgunmobilya.com/userfiles/file/94471683858.pdfIn PDF document text
- http://plenar.hr/wp-content/plugins/formcraft/file-upload/server/content/files/160b06a4d8d1d4---jawezitudekifuwonimo.pdfIn PDF document text
- http://triumphtoday.org/wp-content/plugins/formcraft/file-upload/server/content/files/160bccb0d4a2bb---mopope.pdfIn PDF document text
- https://akdenizokullari.k12.tr/wp-content/plugins/super-forms/uploads/php/files/bnho6d7ehtsgbd3pcdddbvjn34/74047254852.pdfIn PDF document text
- http://modelkyujin.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c35eb827cf0---11501296287.pdfIn PDF document text
- https://oknoplus-omsk.ru/wp-content/plugins/super-forms/uploads/php/files/dabbc37b32e29221ed14400388dd3f49/13414099851.pdfIn PDF document text
- http://www.fullmooneye.com/wp-content/plugins/formcraft/file-upload/server/content/files/160df2a738b5e3---8140092588.pdfIn PDF document text
- http://arch-teh.com/pic/userfile/difasemomabazojenog.pdfIn PDF document text
- https://jnfarley.com/wp-content/plugins/super-forms/uploads/php/files/387scb7j2pvaoddnigrmgqgvh1/wisosomaketo.pdfIn PDF document text
- https://sweetestspaparty.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b157db61c9---parelexaz.pdfIn PDF document text
- http://for-rent-leuven.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609322f59ab92---20986807988.pdfIn PDF document text
- http://kingspec.su/wp-content/plugins/super-forms/uploads/php/files/jnhtdush0t632v7oc73hf073t6/5404041992.pdfIn PDF document text
- https://vickers-electronics.co.uk/wp-content/plugins/super-forms/uploads/php/files/fc1fbf3b5eb0c61d7181801f8c3c6bb5/damezenujamerip.pdfIn PDF document text
- http://a-daily.jp/app/webroot/contents_img/files/689748425.pdfIn PDF document text
- http://orbitsecurity.qa/pro_mvp_tech/uploads/file/turupejatalewub.pdfIn PDF document text
- http://www.stockholmswingallstars.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073b165ef986---9164911291.pdfIn PDF document text
- http://plenar.hr/wp-content/plugins/formcraft/file-upload/server/content/files/160c54ee33fe18---kuvoraxosibepipup.pdfIn PDF document text
- http://www.siscard.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bfdc96b0ac3---56301710570.pdfIn PDF document text
- https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/8b02e54c5ce784ac249505bbfe45a127/masepofatirapafodu.pdfIn PDF document text
- https://digidatadecolombia.com/wp-content/plugins/super-forms/uploads/php/files/9fdb13fbe4b6eaaca6ccdf8840029d67/22537313622.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=class+6+ratio+and+proportion+worksheetPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d224.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD224	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000ea36.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEA36	18440 bytes
SHA-256: `54c8c6903948585fec869a02feb9f5c3afa863f0d7831d1f4df5c768fd2b64b6`
`font_02_sfnt_off00011adb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11ADB	10868 bytes
SHA-256: `225360bd6784dbbda1b339eb88cf1bbec33335fa1e161a63d4709d49979621c1`
`font_03_sfnt_off000133f8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x133F8	16072 bytes
SHA-256: `cab8ceee6dea85bf437db9fdd562b8a0aef74c4066cefe7f2a83a632bdc35db7`

Open this report in the interactive analyzer, or submit your own file for analysis.