Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b0e6e8a797262d9…

MALICIOUS

PDF

85.5 KB Created: 2021-05-23 03:14:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1294aea98e3cfd376ab67d3660ef4090 SHA-1: f01117c21eb5d343ec10bdba41c0962a290aa3c2 SHA-256: 8b0e6e8a797262d90f805ccc939f02b43fb871b46eb167199091bdf430d9fbae
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links pointing to compromised WordPress sites, likely intended to host malicious files. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a pattern of using disposable hosting and search engine optimization tactics to distribute these links. The ML classifier strongly flagged this PDF as malicious, supporting the conclusion that it is part of a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9709

Heuristics 4

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://stcatherine.ac.ug/wp-content/plugins/formcraft/file-upload/server/content/files/160a169d17e789---45653610559.pdf
    • https://www.jemelectric.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f95bda8a35---susojupuneterajag.pdf
    • http://www.pilonidalsinus.gen.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1606cb79c6df2d---45034634004.pdf
    • https://www.kbstephens.com/wp-content/plugins/super-forms/uploads/php/files/7b21901d8d37705972966ab5f96ae493/rasimudugudawewekuwef.pdf
    • http://fashioneducation.ru/userfiles/file/43494520076.pdf
    • https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/765uediuepj5jnv4u4rdbirhed/bebavuvo.pdf
    • https://action-roofing.com/wp-content/plugins/super-forms/uploads/php/files/f6a63f020d601613470135a391a282fc/12369876129.pdf
    • https://anandamsanyal.com/userfiles/file/21576760399.pdf
    • http://extreamtuning.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160793dc002d8f---retenivufogutavuwexojegas.pdf
    • https://ildiko-szepsegszalon.hu/userfiles/file/46270480634.pdf
    • http://www.prieteniitehnicii.ro/documente/file/22649035180.pdf
    • https://yellowstonewildlife.com/98737318787.pdf
    • http://cuatro-pr.org/sites/default/files/file/96442536799.pdf
    • https://tfnd.org/wp-content/plugins/super-forms/uploads/php/files/170052ba09829d87a68242d97bc0700f/26229417636.pdf
    • http://mko-yug.ru/wp-content/plugins/super-forms/uploads/php/files/e750cee955ef4119cf49cc9a8dea3861/71337057532.pdf
    • http://afghansolar.com/userfiles/file/mujegilevogizofuni.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/PmAiG5ZyT-k/uplcv?utm_term=fortnite+avengers+endgame+apk+download
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e010.bin
729c61919de10ed54502f7d5e40dca3786ff5e5af72f7e76705b696f7337f5b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE010 4864 bytes
font_01_sfnt_off0000f115.bin
159008cd4744195f740043f7a0c297b5ff304b14204dcc15f9e4fbe9aad3beaf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF115 5236 bytes
font_02_sfnt_off000102d8.bin
cd0f4459de52dfd6ad42251c6369362a9af6018fafeec65dcaeb8cee15515f08		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102D8 5812 bytes
font_03_sfnt_off0001116f.bin
b2f5bc3c63625e70d80137a2f259b789eb8de1a6b6fac49089bee5a25da270f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1116F 19356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.