Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d71169f6309f9cc…

MALICIOUS

PDF

68.4 KB Created: 2021-05-19 04:25:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 661f40080f8f49cda06574a91243c223 SHA-1: 32829a822020c29607acc23f610d34e864acb100 SHA-256: 7d71169f6309f9cc58dda8974493ad40d6114f946c7a7fde18d01c2c8ec9d92e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous links pointing to compromised WordPress sites, suggesting a link farm designed to distribute malicious files. The document body, though heavily obfuscated, appears to be a lure for downloading security software. The ML classifier strongly indicated maliciousness, and the presence of multiple links to compromised CMS uploads supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9862

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.peeryhotel.com/wp-content/plugins/super-forms/uploads/php/files/f3e1c89a7baa31e299f4a4ed3ad4bb13/rebidubasi.pdf
    • https://www.lumisolar.pe/wp-content/plugins/formcraft/file-upload/server/content/files/16072da218e2e2---6309493525.pdf
    • http://www.jindatunnel.com/up_files/file/48824593798.pdf
    • https://www.swx.global/wp-content/plugins/super-forms/uploads/php/files/90562da77987910e564e1ab193e24005/kuworaxivokerajani.pdf
    • https://realestateconnect.biz/wp-content/plugins/super-forms/uploads/php/files/l4bn8e39utvocote1ie5ma1l25/96566183522.pdf
    • http://beautybybelief.com/admin/images/file/mawuliniza.pdf
    • https://tamtam.com.ua/wp-content/plugins/super-forms/uploads/php/files/7f72219221d68b1276d12e7ae26ce819/13940988970.pdf
    • https://landlorddebtadvisory.com/wp-content/plugins/super-forms/uploads/php/files/c15on6map5sc8bo2a1ss44nba3/60297799961.pdf
    • https://www.acetechnology.co.in/wp-content/plugins/super-forms/uploads/php/files/h6st7irr9ql1qqbu5ho4d98qkd/puraj.pdf
    • http://beiks.info/public/file/ruvogur.pdf
    • http://braintradingbcn.com/wp-content/plugins/super-forms/uploads/php/files/e139b74f137c371979779b234315ee1b/zolafuxijiropavokodame.pdf
    • https://hartwellcook.com/wp-content/plugins/super-forms/uploads/php/files/4a542d9fbfc8ae614fd8b7c5ed06ecd7/1017428546.pdf
    • https://www.taxiserviceh24.com/wp-content/plugins/formcraft/file-upload/server/content/files/16076ecf977f36---86669785199.pdf
    • http://nordicaluminium.ru/userfiles/file/najupu.pdf
    • https://webupdate.ca/wp-content/plugins/super-forms/uploads/php/files/3uv46ieavg8sj0bh6369s1p1se/46633606279.pdf
    • http://prodesign31.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16088b90cb786f---62539523821.pdf
    • http://steclotildehorton.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160a1349481dc3---vimok.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=microsoft+security+essentials+for+windows+7+32-bit+free+download+2020
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d75e.bin
ff13691813765f87628dbb314a1006bb1e93358cbb982950d4e184e82062d0f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD75E 5904 bytes
font_01_sfnt_off0000ebb4.bin
9de0f2d3df793fe679b744277828fc56c77d5ccc52575ddcc379fbdf772c6908		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBB4 10484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.