Malicious PDF — malware analysis report

Static analysis result for SHA-256 e8b71e69d0252a69…

MALICIOUS

PDF

96.7 KB Created: 2021-06-26 17:51:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: 11d1d5a522e40c61ad84bee98ea80833 SHA-1: fc9cc066bd24f361c5fea9bb6750fbafc3af1ab2 SHA-256: e8b71e69d0252a691d82c0f8b98fa116ddd7981e8fe917cf86ca09523f912cfc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a link farm pointing to numerous compromised WordPress sites and other disposable hosting, which in turn host further PDF files. This suggests a multi-stage attack where the initial PDF serves as a lure to download more malicious content. The ML classifier strongly indicated maliciousness, and the structure of the PDF with numerous external links supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9930

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/uplcv?utm_term=angry+love+quotes+malayalam PDF link annotation
    • https://appvid.eus/userfiles/files/nepejasuxikog.pdfIn PDF document text
    • https://ahreco.com/uploads/news_file/9037545898.pdfIn PDF document text
    • https://pluviaterra.mx/wp-content/plugins/super-forms/uploads/php/files/3eb56dbe0cf53de24881c0f1285168eb/30985747902.pdfIn PDF document text
    • https://whitelightdesign.com/wp-content/plugins/super-forms/uploads/php/files/b6041dc642bd0138889aa3db39347771/nobuwuwaz.pdfIn PDF document text
    • http://bhs-class1957.com/clients/35434/File/nomofolipobiw.pdfIn PDF document text
    • https://broadstripe.com/wp-content/plugins/super-forms/uploads/php/files/fce993d1d5a720c35eab4a4eb84acdcf/losuvuridabotuzezovaf.pdfIn PDF document text
    • https://extremetour74.ru/wp-content/plugins/super-forms/uploads/php/files/c6cb233b7fedcffe46231d7ae0bdbb26/womilepaxezidulo.pdfIn PDF document text
    • http://stuarteisbrucklaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/62402427549.pdfIn PDF document text
    • https://rmissio.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160cf248aecfff---fulot.pdfIn PDF document text
    • http://www.iso-clean.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1607748850fd5b---boxuvoloxa.pdfIn PDF document text
    • https://west-holding.com/userfiles/file/malutikusu.pdfIn PDF document text
    • http://farmina.ru/uploads/files/98774195775.pdfIn PDF document text
    • https://festivalecolo.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160c094d639b91---boneju.pdfIn PDF document text
    • https://capitaleny.com/wp-content/plugins/super-forms/uploads/php/files/3f90d07cf1b7184f5840862b063d8844/78846222841.pdfIn PDF document text
    • https://bistro-8.com/wp-content/plugins/super-forms/uploads/php/files/89033a26632ce0e3d5293b3e0a39341f/xolizedugaduriwiz.pdfIn PDF document text
    • http://akbmodel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160add1a458e64---bizux.pdfIn PDF document text
    • https://traveletrust.com/basefile/traveletrustcom/files/89671671496.pdfIn PDF document text
    • http://www.caslyn.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16098fc483fe52---87495909692.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160abd84dd1322---14269172223.pdfIn PDF document text
    • http://stopasbestos.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160a01fe870c27---65536804936.pdfIn PDF document text
    • http://trackeg.com/en/wp-content/plugins/formcraft/file-upload/server/content/files/1606fe76012f85---58152840361.pdfIn PDF document text
    • https://voolabs.com/wp-content/plugins/formcraft/file-upload/server/content/files/160919bb9c2f2d---wutidutawu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9E3 20604 bytes
SHA-256: df976aa06acd99e9918c5b3477d969ae164feb73d550a6f82d9d482194b00c24
font_01_sfnt_off00012b79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12B79 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00014390.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14390 10764 bytes
SHA-256: 64a277b0a626db4f63e96845365a3544fce437ea3e3a47d2ca51d78519108e35
font_03_sfnt_off00015c1d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15C1D 17444 bytes
SHA-256: e5b374e82f105ae5a71102a8444a39f63df647d526e73cef5e919040a066dee4

Open this report in the interactive analyzer, or submit your own file for analysis.