Malicious PDF — malware analysis report

Static analysis result for SHA-256 9206191bee8d425a…

MALICIOUS

PDF

102.3 KB Created: 2021-08-06 23:58:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: 23b4d7dacdacd1c5a7c8795ed3c3b342 SHA-1: cd204b3b6da39001bfb657c4bea1f06828395b48 SHA-256: 9206191bee8d425a69eee8808249920883f6f5ae3d57010ee7505c8f9eb9000a
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains embedded JavaScript, which is often used to redirect users to malicious websites or download further payloads. The document also functions as a link farm, with numerous URLs pointing to compromised WordPress sites, suggesting an attempt to distribute malware or engage in SEO abuse. The ML classifier strongly indicates malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9851

Heuristics 6

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://unicornproduction.gr/wp-content/plugins/super-forms/uploads/php/files/fd5b1a23080fc274906567944d83e6a2/42666980200.pdf In PDF document text
    • https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ffc3c368ac---98182224822.pdfIn PDF document text
    • https://www.apartamentselsllacs.com/wp-content/plugins/super-forms/uploads/php/files/4bf3g1ordjn94clf7oq60t4ivf/poxobiwifen.pdfIn PDF document text
    • https://divorcioconsensual.com.br/wp-content/plugins/super-forms/uploads/php/files/96e8b1fde1ba92acb55d690482214ce8/96131369968.pdfIn PDF document text
    • http://2girlstrippin.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b87d7a4aa9a---14957695861.pdfIn PDF document text
    • http://metrokentakifinan.com/resimler/files/51877998880.pdfIn PDF document text
    • http://www.rolstoellift.com/wp-content/plugins/formcraft/file-upload/server/content/files/160abfc227959f---gezufiborewawomidebisupix.pdfIn PDF document text
    • http://www.sunarsurdurulebilir.com/wp-content/plugins/super-forms/uploads/php/files/p2veagdja5ie2bk28m4amfcup3/goneruronasofepegis.pdfIn PDF document text
    • http://stepsforstarlight.org/clients/c/c6/c668404594a1c08d975ab50c7bec58f6/File/27489273536.pdfIn PDF document text
    • http://wu-pao.com/upfiles/editor/files/xerivasa.pdfIn PDF document text
    • https://www.dynasil.com/wp-content/plugins/super-forms/uploads/php/files/1389003ee2733864cf4eb0d94bb2689d/86575167176.pdfIn PDF document text
    • https://advancedbusiness.co/wp-content/plugins/super-forms/uploads/php/files/5a886fc2063ac6cadd32721c3d491ab7/11603469749.pdfIn PDF document text
    • http://paintingservicesonline.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160b0ee5ca9386---resudun.pdfIn PDF document text
    • http://osullivanspressurewashing.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4ed837e664---53229524296.pdfIn PDF document text
    • http://hiace-yoshikawa.com/js/upload/files/kulexopuri.pdfIn PDF document text
    • http://stallingreunion.com/clients/a/a3/a37dbb3dca22f8cb40f44de83fe48269/File/vetetoziwenabutelivu.pdfIn PDF document text
    • http://www.bewegeninarnhem.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16076eeaae95e0---35892731541.pdfIn PDF document text
    • http://osullivanspressurewashing.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d21db4735d9---bixupapirurenilefu.pdfIn PDF document text
    • https://perleyparish.org/wp-content/plugins/super-forms/uploads/php/files/d44d3f084ca77802b9ad37c8ec89fadf/vepijafizaruj.pdfIn PDF document text
    • https://drvishweshwari.in/userfiles/file/maxaxe.pdfIn PDF document text
    • https://g3az.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608de28789ccf---52802178676.pdfIn PDF document text
    • http://alvasari.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071492bc6eb7---15933789738.pdfIn PDF document text
    • http://alimentosldm.com/userfiles/file/80889001308.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=wonder+woman+1984+full+movie+movie4kPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010168.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10168 11092 bytes
SHA-256: a307749ae4804c91a347f425998ac0e8c947416ac9c5612f0ca52727a35d9e95
font_01_sfnt_off00011b5b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B5B 3344 bytes
SHA-256: 7579018a5dad453634d5cb19a86257141fc3b034c97b05ffadd6da96e9e3e429
font_02_sfnt_off000128e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x128E9 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off000140fb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x140FB 18344 bytes
SHA-256: 34c80b39efa86bb3b33a2abce8a66a233efdcf4132a7fa9d9c744d3592356aa5
font_04_sfnt_off000171cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x171CC 16448 bytes
SHA-256: 1abcdf734f53c6faa3ad03a7310a5f36aa84cadd40084821435203ed8c34e9d6

Open this report in the interactive analyzer, or submit your own file for analysis.