Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4ea8756ab9fcfc4…

MALICIOUS

PDF

77.2 KB Created: 2021-09-01 11:46:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: 98e465f0fad11c1d22573f298f79852d SHA-1: 5f46bb52540ad749cf7b2f0e8742ff81bebeac30 SHA-256: e4ea8756ab9fcfc4904c1319f54c5ae8dcefe3022e5922dd6bbb8e63624eb482
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external URIs, many of which point to compromised WordPress sites. The ML classifier strongly indicates maliciousness, and the structure suggests a link farm designed to distribute traffic or potentially host malicious content. No scripts were extracted, but the overall pattern of linking to potentially compromised sites is suspicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://huntic.ru/uplcv?utm_term=nail+shop+on+35th+giles PDF link annotation
    • http://bridgesonthepark.com/wp-content/plugins/formcraft/file-upload/server/content/files/160de200f368ac---kidesakaso.pdfIn PDF document text
    • http://makaifruits.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610321aa18bf3---18095517280.pdfIn PDF document text
    • http://bajajsports.com/userfiles/file/48035043426.pdfIn PDF document text
    • https://skatrip.com/basefile/skatripcom/files/29132350631.pdfIn PDF document text
    • https://www.tai.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160c9f8f921c7e---56100090916.pdfIn PDF document text
    • https://askopenko.com/wp-content/plugins/super-forms/uploads/php/files/e983866410b57644f7057d36769434a5/15281428202.pdfIn PDF document text
    • http://ahkjt.com/upfile/file/88124267092.pdfIn PDF document text
    • https://cornwallstaffagency.com/userfiles/file/gofawezanofusul.pdfIn PDF document text
    • https://primeodontorj.com/wp-content/plugins/super-forms/uploads/php/files/ae7941d3b27c57d5973facb49ca5f6e6/17464629889.pdfIn PDF document text
    • http://inruho.ru/ckfinder/userfiles/files/88614239805.pdfIn PDF document text
    • http://steelbo.com/uploads/admins/u0/files/20210705062348.pdfIn PDF document text
    • https://csom.cz/wp-content/plugins/super-forms/uploads/php/files/8aa81d5a15cb791e3c9284065c50cb4e/revor.pdfIn PDF document text
    • https://www.growxponential.com/wp-content/plugins/super-forms/uploads/php/files/k9ttpfh1g5lt595jk6ect52u89/fibazugotazepewileromupa.pdfIn PDF document text
    • http://highlandcougars83.com/clients/2/26/268573c5102cd00412bac87cee9346ec/File/gitofatitem.pdfIn PDF document text
    • http://www.de.ruben.pl/ckfinder/userfiles/files/sifegevidu.pdfIn PDF document text
    • https://www.enterpriselighting.com/wp-content/plugins/super-forms/uploads/php/files/269b2871baa04e8aa88b235e6190e2ce/31109807847.pdfIn PDF document text
    • https://avela.md/userfiles/file/23676267253.pdfIn PDF document text
    • http://www.suffaheducation.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080a1730b948---72771484472.pdfIn PDF document text
    • https://ailani.org/wp-content/plugins/super-forms/uploads/php/files/43bb197425672b4b668ac2696a066a80/nubonutevexozezoxijiruzan.pdfIn PDF document text
    • http://fzcce.com/aimgs/uload/files/xagodofusajusosikov.pdfIn PDF document text
    • http://bualuang101.com/backoffice/upload/files/taxuv.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16104135104f04---witefiwuwesifuxa.pdfIn PDF document text
    • http://witnesstherealist.com/wp-content/plugins/super-forms/uploads/php/files/7f18dddeff27b04e2dcfe2d7eceb9f90/fevulexotetiwito.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c6aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC6AA 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000dec1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDEC1 10716 bytes
SHA-256: fad38d2b7915f255808c7058f64bcec380a3fab0f127ace1d1f2f42d1f429751
font_02_sfnt_off0000f75a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF75A 18240 bytes
SHA-256: 45192282ab0911625c5645b77d86f7c1f39be918ef76fd70f9db9d1d22323c07

Open this report in the interactive analyzer, or submit your own file for analysis.