Malicious PDF — malware analysis report

Static analysis result for SHA-256 bc3d64d15bd96bb6…

MALICIOUS

PDF

78.5 KB Created: 2021-05-25 04:41:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 62661566839cab73df991d7ba28544ae SHA-1: e8cdb89953c3e11c4c8c9c7d899e3340b00b636c SHA-256: bc3d64d15bd96bb6b7b4132b8019b12555ca08210d71d7cb5bd17148014032e0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by an ML classifier as malicious. It contains a link farm pointing to multiple compromised WordPress upload directories, suggesting an attempt to host and distribute malicious files. The document body, though heavily obfuscated, appears to be a lure related to game settings, likely intended to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.nowsingapore.co.id/wp-content/plugins/formcraft/file-upload/server/content/files/16081f9ac1b478---22320912827.pdf In PDF document text
    • https://celovechurch.org/wp-content/plugins/super-forms/uploads/php/files/4c06bedea4e6a616b4ae47dc9093b710/30703396906.pdfIn PDF document text
    • https://cmsschoolkg.org/userfiles/file/57087286443.pdfIn PDF document text
    • https://englewoodgrassfarm.com/wp-content/plugins/super-forms/uploads/php/files/88eb41b6f1c1e0ea338106a092a0dec5/38246545373.pdfIn PDF document text
    • http://www.idenet.net/wp-content/plugins/formcraft/file-upload/server/content/files/16081d96522859---tofutoveje.pdfIn PDF document text
    • https://svetpoznaniyaonline.ru/wp-content/plugins/super-forms/uploads/php/files/3007a660c28665fa808c9c19ca7d0097/73884060508.pdfIn PDF document text
    • http://www.chinahkcarplate.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c7b1b35e36---nenevofoxozorozanenetu.pdfIn PDF document text
    • https://vaytieudungtragop.com.vn/wp-content/plugins/super-forms/uploads/php/files/s18pkjgvvjg2hp9bkdf0idk27n/63637711167.pdfIn PDF document text
    • https://www.helpforbusymums.com/wp-content/plugins/super-forms/uploads/php/files/23816a64f5a2d618ed0230ba8cda4cfd/rerexezexokofafu.pdfIn PDF document text
    • http://www.lightingandhvacexpo.com/wp-content/plugins/super-forms/uploads/php/files/201ac656fed210d739dc0da48385a394/13673357087.pdfIn PDF document text
    • http://www.ellisrasbetonwerke.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16077064f71421---32497765750.pdfIn PDF document text
    • https://www.tai.gr/wp-content/plugins/formcraft/file-upload/server/content/files/16081cd8ab1969---33287124125.pdfIn PDF document text
    • http://localhomesales.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160872617996e4---pafikibotilekedugo.pdfIn PDF document text
    • http://nuestratierrapremios.com/campannas/file/68973858856.pdfIn PDF document text
    • http://serendipityorlando.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a692f1cae4---71057079629.pdfIn PDF document text
    • https://daluxerealty.com/wp-content/plugins/super-forms/uploads/php/files/8vf1pfae6stj7nlkd4sgio7lp0/nofamifuweruwesuvikezole.pdfIn PDF document text
    • https://higher-reason.com/wp-content/plugins/super-forms/uploads/php/files/2ph1jlb7d60s08qlsuehnekif8/97755403979.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=best+sensitivity+settings+for+pubg+mobile+no+recoil+2020+without+gyroscopePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD3CD 5936 bytes
SHA-256: e797b6d3fc8d6b7a321b78906e7027192d62f01d1ef0cf70e66fa74f43cbe50b
font_01_sfnt_off0000e805.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE805 10348 bytes
SHA-256: 52fd7ab45af3bdce1b0f7b0a16a99b6916df0fe336ceff956163599fcea8a378
font_02_sfnt_off00010b68.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B68 18692 bytes
SHA-256: bfe61a97354eb60bf4ba1f4ddc839d383db97810608e8733eb30311703afe907

Open this report in the interactive analyzer, or submit your own file for analysis.