Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1b17cbf9ee21028…

MALICIOUS

PDF

94.7 KB Created: 2021-07-14 06:43:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 152812a9c1359c55db2442632491163e SHA-1: c304ce6ee12f5c2328513319faea48d9245f4224 SHA-256: c1b17cbf9ee210283a8c6c431c319f11006deaffc20b580129971c5d8fcdacbd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, many of which point to compromised WordPress sites. The ML classifier strongly indicated maliciousness, and the structure suggests a link farm designed to redirect users to potentially harmful content. No scripts were extracted, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9936

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://amesmedicalservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609ce0ff6c7ec---37793366795.pdf In PDF document text
    • http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/160b40e0ead62a---ragikijevunokoredemipix.pdfIn PDF document text
    • http://ibookingkr.com/FileData/ckfinder/files/20210706_820871E66E5FB5FE.pdfIn PDF document text
    • http://www.radioemka.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f2c781207f---84310285864.pdfIn PDF document text
    • https://slavica.ru/wp-content/plugins/super-forms/uploads/php/files/c6c03ce57dc0642ca4f8a509af758db1/62865546159.pdfIn PDF document text
    • https://joefairless.com/wp-content/plugins/super-forms/uploads/php/files/2dff5063fa863239fa2787e422cedd5d/bosoximezovadijebobagutu.pdfIn PDF document text
    • http://chagatea.ru/wp-content/plugins/super-forms/uploads/php/files/947163b461e59e381461c61743186505/pinenirakeg.pdfIn PDF document text
    • http://dodici12.ru/wp-content/plugins/super-forms/uploads/php/files/ca2mtkdvkggjvat08ekl28sfk4/15939577996.pdfIn PDF document text
    • https://playgametoday.ru/wp-content/plugins/super-forms/uploads/php/files/9c89b930bf77681e8b810f3c43b6f0ee/dowifevovifak.pdfIn PDF document text
    • http://princeworldwide.com/multimedia/userfiles/file/6097180401.pdfIn PDF document text
    • https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/1609e5a5f5bc7b---tezanuruv.pdfIn PDF document text
    • http://ed-web.cz/userfilesfile/zufetijosepugewetibe.pdfIn PDF document text
    • http://szakkepzosiklos.hu/upload/file/53357645873.pdfIn PDF document text
    • http://m2mus.ca/clients/b/b1/b1ca46fdb12d68e762e4a8b3318caec0/File/1713639300.pdfIn PDF document text
    • https://jetzterstrecht.hamburg/wp-content/plugins/super-forms/uploads/php/files/hleotjbvsjle9tt6kk14i340g7/siripunegipadaw.pdfIn PDF document text
    • http://www.mondzorgvesa-voorschoten.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607cde9a5996f---batokewezaresozomob.pdfIn PDF document text
    • https://bentzendesign.se/wp-content/plugins/formcraft/file-upload/server/content/files/1607e45f620776---64992601508.pdfIn PDF document text
    • http://laweasy.kr/userfiles/file/tametalibisejinavafowiw.pdfIn PDF document text
    • https://www.beachesbrewing.com/wp-content/plugins/super-forms/uploads/php/files/77ecf1d8317ee0606dcafb7c7de58e01/zoripemimivugewarudo.pdfIn PDF document text
    • http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/khq4h0p7stf22oqtfp3pmi19c3/kidalabazanamomuvagofop.pdfIn PDF document text
    • http://nhuaduongnhapkhauaz.org/upload/files/zutixosamirepunufefew.pdfIn PDF document text
    • http://www.colegiometa.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/1608d57a52d5d8---85420885672.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/1KS0DP0cxss/uplcv?utm_term=ielts+speaking+vocabulary+band+7PDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA76 16596 bytes
SHA-256: 184ab809086e5bfc9b03d0c528043bb47b9dca6990fbcc49fe7da2f256c59147
font_01_sfnt_off000125ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125AC 11204 bytes
SHA-256: 15b6dd23051444e78770f0134de152de9a869695e2ef6a804e4e62bb125cf54e
font_02_sfnt_off00013fb8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13FB8 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off000157c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x157C9 16068 bytes
SHA-256: 6d636ebcb28a43c11a0b96216d988d0aaa25e428b847d4e039b2a2a6b6e27b6d

Open this report in the interactive analyzer, or submit your own file for analysis.