Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6935779b926a522…

MALICIOUS

PDF

111.8 KB Created: 2021-07-13 08:02:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-15
MD5: e414a41e5d3ac0f477e02f6bd69501b2 SHA-1: 1daf2a4dea5931a3a928d398bd9d5844fed247fd SHA-256: e6935779b926a522250ea755072aec7ca75bf293d712f226a908bf34f6723b1e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous embedded URLs, many of which point to compromised WordPress sites utilizing the 'formcraft' plugin for file uploads. These URLs are structured as a link farm, suggesting an attempt to distribute malicious content or redirect users to phishing sites. While no scripts were directly extracted, the ML classifier strongly indicated maliciousness, and the nature of the embedded URLs points towards a spearphishing attachment attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9729

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.burit.net/wp-content/plugins/formcraft/file-upload/server/content/files/160a731ed87325---jelosodurazixexazo.pdf In PDF document text
    • http://changecn.net/ckupload/files/38724491899.pdfIn PDF document text
    • http://structurecreative.com/wp-content/plugins/formcraft/file-upload/server/content/files/160914a7992246---nodasaximinibu.pdfIn PDF document text
    • https://www.zaantraining.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608eb80029983---digozaseredejunod.pdfIn PDF document text
    • https://israelonthehouse.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c2a3ddc489---rolajetipirego.pdfIn PDF document text
    • https://microfocus-realize2020mea.com/wp-content/plugins/super-forms/uploads/php/files/9ba38a4255fe0be5695bc5b7b6af0702/tigapisojugu.pdfIn PDF document text
    • https://stallion-international.com/userfiles/file/ratezixikobofesure.pdfIn PDF document text
    • http://akicgiyim.com/userfiles/file/vurizuvemokosuwijab.pdfIn PDF document text
    • http://www.tecnotrefg.it/wp-content/plugins/formcraft/file-upload/server/content/files/16092432c1db45---gadajokagimopiziwodadog.pdfIn PDF document text
    • https://udachi.co.th/wp-content/plugins/super-forms/uploads/php/files/g65vaoatrjq6alam54bjf1h51q/didiberudetagupa.pdfIn PDF document text
    • http://lempreintedubois.fr/userfiles/lempreintedubois.fr/file/89762465198.pdfIn PDF document text
    • http://averon.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16088f4b1e4fd4---warisejepevu.pdfIn PDF document text
    • http://krevue.cz/UserFiles/File/ruxumugajigod.pdfIn PDF document text
    • https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/7o96nkrrcjqplhvn4ubdo447gi/xazalinojam.pdfIn PDF document text
    • https://www.lipfish.no/wp-content/plugins/formcraft/file-upload/server/content/files/160c50286eaf81---5574763967.pdfIn PDF document text
    • http://www.cenlajobinator.com/siteuploads/editorimg/file/63778399729.pdfIn PDF document text
    • https://ivanamihic.com//files/tijanozokuwigovifu.pdfIn PDF document text
    • http://rocincorporated.com/domain.com/images/dynamic_pages/file/nevazutaginunenafaxa.pdfIn PDF document text
    • https://massagetheory.ca/wp-content/plugins/super-forms/uploads/php/files/42094f88f4d27b5ba037fd151e1fa47c/45244347127.pdfIn PDF document text
    • https://purebodycare.courses/wp-content/plugins/super-forms/uploads/php/files/h079eki3m33vmrt7elufpflmj1/wujoziwigometitokokonev.pdfIn PDF document text
    • https://web-sila.ru/wp-content/plugins/super-forms/uploads/php/files/ed8eb239b05001fd17126aa72819d6ea/galajisatigutosuwovez.pdfIn PDF document text
    • http://ateliergermain.net/sites/default/files/file/40706264125.pdfIn PDF document text
    • http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/16075e9e09ebb9---mibawemujuxuxitatime.pdfIn PDF document text
    • https://event-connections.net/wp-content/plugins/formcraft/file-upload/server/content/files/16093b677eac68---riregudumu.pdfIn PDF document text
    • http://lubrifianti-auto.ro/files/file/safevadaviluxe.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/S30rS-6n6vg/uplcv?utm_term=most+populous+urban+areasPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012bed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12BED 1892 bytes
SHA-256: 3a9e35e229ee190e3b19ffb0d3e270a89bdb85dc90529ceb607b92b90940987c
font_01_sfnt_off000134a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134A5 18352 bytes
SHA-256: 9346c9a990c475505754341fdfa3b9a8dca918821ce774c8b0075b823e26159c
font_02_sfnt_off00015176.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15176 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off00016988.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16988 18608 bytes
SHA-256: f6b615265a74cdcbdaf8e18a1e6df2cd1d1686c4eaa43182c33dabbee97517bd
font_04_sfnt_off0001998d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1998D 10388 bytes
SHA-256: 9094abb8ff246844f45c2d5c0fb7318bfac4e61c38baf33670ce9da30871d560

Open this report in the interactive analyzer, or submit your own file for analysis.