PDF malware analysis — malicious · 00d47111f25d4d16

MALICIOUS

PDF

82.2 KB Created: 2021-09-12 21:13:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27

MD5: d7c98ef88e8e8ccb29bb1353c908a4cd SHA-1: 29a87e1d971ddddcbfdb939fdfb2430e622f5132 SHA-256: 00d47111f25d4d16ddb023c866c21f3fa3fa1bd62054a453cdcc15de7edeffaa

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous links, many pointing to compromised CMS upload directories and disposable hosting, suggesting a link farm designed to redirect users to malicious sites. The presence of these links indicates an attempt to deliver a payload or phish credentials.

Machine Learning

Nyx PDF Classifier malicious score 0.9974

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://santehsevast.ru/userfiles/files/8892731952.pdf In PDF document text
- http://czpohledavky.cz/userfiles/files/48289644051.pdfIn PDF document text
- https://www.urban-quartz.co.uk/wp-content/plugins/super-forms/uploads/php/files/e54c0a1f2eadea5d9e2377bc4e9af68a/9397091155.pdfIn PDF document text
- http://leebyenghun.com/new/upload/board/files/dakoliwurisozikudaxukiv.pdfIn PDF document text
- https://artistprasanna.com/userfiles/file/tefebotifudotuwor.pdfIn PDF document text
- http://sinara.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/161309175f0f21---zeserafokekozuku.pdfIn PDF document text
- http://nd-58.ru/wp-content/plugins/super-forms/uploads/php/files/d5f6efcd53e82c5a3db82ac7a6a3c9f9/36715977422.pdfIn PDF document text
- http://citygclub.com/ckupload/files/zomesunujoxulanibuwela.pdfIn PDF document text
- http://telecycling.org/files/file/bisanarerul.pdfIn PDF document text
- http://www.kliningstroy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16135ed724609b---79103723594.pdfIn PDF document text
- https://webmenuplus.com/images/file/zixitomena.pdfIn PDF document text
- https://manorhair.com/uploads/files/202109040807518439.pdfIn PDF document text
- http://designbyjoseph.com/uploads/File/faduburovedapenagi.pdfIn PDF document text
- http://starcity-vinhomes.vn/app/webroot/img/files/35239424529.pdfIn PDF document text
- https://www.loisirs-auto-occasion.fr/ckfinder/userfiles/files/29429646810.pdfIn PDF document text
- https://www.marthatrotts.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16133bbc8ebfca---21205651138.pdfIn PDF document text
- http://hzxf.com/images/upload/File/kizofawerogesi.pdfIn PDF document text
- http://laiksmodalux.lt/app/webroot/uploads/userfiles/files/wimakufakagoseveboxov.pdfIn PDF document text
- http://rasmesafar.net/basefile/basefiles/tagafejotofufusuv.pdfIn PDF document text
- https://cosmopolitanhotelbg.lastrada.bg/uploads/wysiwyg/files/sipumunofafijokide.pdfIn PDF document text
- http://adacu.org/userfiles/file/20210911000434.pdfIn PDF document text
- https://costumeworld.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612ea5f11f9b6---5118104424.pdfIn PDF document text
- https://intrigantka.ru/images/userfiles/file/50285005688.pdfIn PDF document text
- http://benetworkingpro.com/ckfinder/userfiles/files/75897437787.pdfIn PDF document text
- http://zdrowejaja.com/Upload/file/tezin.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=nagin+old+moviePDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000da9c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDA9C	19120 bytes
SHA-256: `eea80984cc62bde9990b871395980865aba4d67f25be074b3cd069c286d0bf3c`
`font_01_sfnt_off00010c02.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10C02	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00012419.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12419	10268 bytes
SHA-256: `0b49c4559c9af249d4d7cc732fbc9e0570a4a1e1478f98f29e35020d5b9afed1`

Open this report in the interactive analyzer, or submit your own file for analysis.