Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0cf9e2e4d3759b1…

MALICIOUS

PDF

62.5 KB Created: 2021-07-25 16:45:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 9cd1f6c6eb33293e31c3a3f0fcaaea87 SHA-1: 78a110946b7d24c0f8403c3e905de0a8e619e235 SHA-256: c0cf9e2e4d3759b1e66b785eec0cd8aa876531dca895331c8869670ac60d5a45
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link farm pointing to numerous other PDF files hosted on various websites, some of which appear to be compromised CMS uploads. This suggests a tactic to manipulate search engine rankings or distribute malicious content through a chain of redirects. No scripts were extracted, and the document body was unreadable, limiting further analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4596

Heuristics 4

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://astorandblack.net/emailer/userfiles/file/84092040650.pdf In PDF document text
    • http://ajk-opakowania.eu/upload/fck/file/8538209538.pdfIn PDF document text
    • http://coinmarketsuite.com/ckfinder/userfiles/files/66149508479.pdfIn PDF document text
    • http://thanuyentea.com/ckfinder/userfiles/files/5953483067.pdfIn PDF document text
    • https://luminex.pl/upload/file/wisafukusogokalipa.pdfIn PDF document text
    • https://pabausa.org/wp-content/plugins/formcraft/file-upload/server/content/files/160be80324c990---24279305892.pdfIn PDF document text
    • https://faltprasten12.se/anvandarbilder/70/files/detupal.pdfIn PDF document text
    • https://ildiko-szepsegszalon.hu/userfiles/file/44720137194.pdfIn PDF document text
    • http://mfcwestenkwartier.nl/beta/userfiles/file/kefureterugeronenizime.pdfIn PDF document text
    • http://hpworld.hu/data/pic/Image/file/vafesep.pdfIn PDF document text
    • https://wurstfargo.com/wp-content/plugins/super-forms/uploads/php/files/3133d981fba4a9ca0418703b24fc753f/89954904886.pdfIn PDF document text
    • https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608219ef16f25---7676101102.pdfIn PDF document text
    • http://baiduvpn.com/upload/files/nanobixadob.pdfIn PDF document text
    • http://stphilomenaonline.org/userfiles/file/tubusenotukesabunesut.pdfIn PDF document text
    • https://stakeoutllc.com/wp-content/plugins/super-forms/uploads/php/files/d757b16970885b85fda0414a8937891f/doxajoxodisosajo.pdfIn PDF document text
    • http://clarasonic.com/upload/file/87452290900.pdfIn PDF document text
    • https://sevsport.info/wp-content/plugins/super-forms/uploads/php/files/a92cce4b3b28c0beb5052681b99b2b62/2831890938.pdfIn PDF document text
    • https://africanresearchcenter.com/userfiles/file/61593807383.pdfIn PDF document text
    • https://jgmurphy.com/wp-content/plugins/super-forms/uploads/php/files/3f50f89d67637f18d39ccffca057767a/fematobuneta.pdfIn PDF document text
    • https://k9-warrior.com/wp-content/plugins/super-forms/uploads/php/files/io1stfvhandev7o27d93jdlku1/33247484867.pdfIn PDF document text
    • https://mymango.ru/wp-content/plugins/super-forms/uploads/php/files/45a5c947eda2a2bedf8a90d62faabee2/mifokovazikol.pdfIn PDF document text
    • https://lecormier-menuiserie.com/www/upload/files/97083601906.pdfIn PDF document text
    • https://messianic.live/wp-content/plugins/super-forms/uploads/php/files/e501827fc0456c806f0757f9d09f52b9/gufafewuvowuzifuvotuk.pdfIn PDF document text
    • https://ladangmimpi.com/contents//files/xefikobiwepawixawiwef.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=libros+dibujos+para+colorear+e+imprimirPDF link annotation