Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed7af5904dd6dee6…

MALICIOUS

PDF

105.7 KB Created: 2021-06-29 15:48:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: f5792dfe473682ed1acb7bef2e59bbfa SHA-1: d98bc79adb6e4ccfcfb5f6fd2b4a2157ff54cff7 SHA-256: ed7af5904dd6dee6ea530374c21288fb3c99e1c969a23c7e1250801d91fb34fd
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The ML classifier strongly indicates maliciousness, supported by numerous heuristics identifying the PDF as a link farm pointing to compromised WordPress sites and external download URLs. The presence of a 'download button' lure further suggests a phishing or malware distribution attempt. No scripts were extracted, but the overall structure and URL findings point to a malicious document designed to trick users into downloading further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9935

Heuristics 6

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oniceh.ru/uplcv?utm_term=clash+of+clans+mod+apk+android+1+download
    • http://abwvictory.com/uploads/files/lusawoliponepe.pdf
    • http://vizesblokk.hu/files/file/56937602222.pdf
    • http://pvsystreports.com/wp-content/plugins/super-forms/uploads/php/files/frsrqj9535poep4p5g6ijdurv3/gopegefivatawusija.pdf
    • https://www.isnb.co.uk/wp-content/plugins/super-forms/uploads/php/files/9e89c3d82e2da29c4d9d694b5437b3e9/79985821317.pdf
    • https://kolodezrus.ru/wp-content/plugins/super-forms/uploads/php/files/c6d491fa29f1cb16a10e07f1de1f9d99/xilasoni.pdf
    • http://www.nandomoraes.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a020f18dec9---44308688252.pdf
    • http://www.adatechotomasyon.net/wp-content/plugins/formcraft/file-upload/server/content/files/160a604e522a69---busufamujugarob.pdf
    • http://www.sunaryem.com.tr/wp-content/plugins/super-forms/uploads/php/files/c3670v0fu87dg299qrccmouk21/mivesunopofumulegod.pdf
    • http://ptk-astana.kz/wp-content/plugins/super-forms/uploads/php/files/e472614c534a964b525b35ea7cf88eaf/desikebimemezopegikaw.pdf
    • https://ajwatravel.com/wheelmarine/userfiles/file/80084218949.pdf
    • https://hogies.com/includes/template/uploads/file/pedos.pdf
    • http://trenermichal.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160aad4ed876fc---susojamazi.pdf
    • https://cashofferoregon.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d6ab2be085b---51351206216.pdf
    • https://ensasoft.com.tr/wp-content/plugins/super-forms/uploads/php/files/c0cvlh8k04bn7acercct57jr1n/75822823624.pdf
    • https://rfcorporation.net/wp-content/plugins/super-forms/uploads/php/files/e4e352ac2eabbb73870264b945cbd888/linetunipifetanutitonamo.pdf
    • http://ateliergermain.net/sites/default/files/file/nesuxuliserukepig.pdf
    • https://malimbe.africa/wp-content/plugins/super-forms/uploads/php/files/fced037e9df31fe62ff75e142fcf3fd3/57233488172.pdf
    • http://xn--9p4b29dncp2cc6y.net/upload/fckeditor/file/vusofefof.pdf
    • https://soudurelauziere.com/upload/editor/file/95107395310.pdf
    • http://sad-azov.ru/wp-content/plugins/super-forms/uploads/php/files/f7eac3d85e7ba4e9116a0b68f313ea7e/rinojikobidotonibetagak.pdf
    • https://premiumvipbusiness.com/wp-content/plugins/super-forms/uploads/php/files/43cb33ea1b599eff3358f3a99e7405a1/19300694878.pdf
    • http://dzstock.com/Upfiles/file/8785776749.pdf
    • https://www.marthatrotts.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609ec38e92408---xotimufekuriwobalobogubu.pdf
    • https://giltmorestukko.hu/ckfinder/userfiles/files/vojapugusesadi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013647.bin
cecadc0be7f66cdcb6e59d97bf805ed1afcc02025fb2a85127629c7060888561		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13647 20028 bytes
font_01_sfnt_off000167fc.bin
d154cba9cee7c0f4e5c9a096b6fba5f66a5662ef3809de60b72055eebd09dbbc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x167FC 10916 bytes
font_02_sfnt_off00018120.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18120 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.