PDF malware analysis — malicious · 023b0e2b304bdaee

MALICIOUS

PDF

69.5 KB Created: 2021-09-07 23:04:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11

MD5: 3403c2eb7402e158ec16e1225733fa18 SHA-1: 56a321f1714ed6c592f06c281b19058a86e0535e SHA-256: 023b0e2b304bdaeecc9fa772e6cba41589b5bda32ab61c772f63cc1367d92e55

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a link farm pointing to numerous disposable hosting domains, suggesting an attempt to distribute malicious content or conduct phishing. The presence of embedded URLs and the nature of the heuristics indicate a likely spearphishing attachment used to redirect users to potentially harmful sites.

Machine Learning

Nyx PDF Classifier malicious score 0.6994

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gocep.org/data/userfiles/files/katozinek.pdf In PDF document text
- http://trackeg.com/en/wp-content/plugins/formcraft/file-upload/server/content/files/160dc33360910a---84570352391.pdfIn PDF document text
- http://i-dron.cz/data/file/45688797113.pdfIn PDF document text
- http://parkwestresidences.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607531e6767e6---59985208570.pdfIn PDF document text
- https://trichynext.com/wp-content/plugins/super-forms/uploads/php/files/a92ed6ca461b07f7ceb525aa345fdbf7/kisati.pdfIn PDF document text
- http://www.fattyweng.com.sg/wp-content/plugins/formcraft/file-upload/server/content/files/1609025da9d760---mukerula.pdfIn PDF document text
- https://www.alignerco.ca/wp-content/plugins/super-forms/uploads/php/files/01b7d8e96587e37be97cfbab4cddc5c8/11477050951.pdfIn PDF document text
- http://ipvoicenj.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bf939518f1a---19619852936.pdfIn PDF document text
- https://micro-churches.net/uploads/file/27750743771.pdfIn PDF document text
- http://www.nanodrywash.com/wp-content/plugins/formcraft/file-upload/server/content/files/160fb1147d3b8f---kupirikojepinafinobel.pdfIn PDF document text
- https://anctools.com/ckfinder/userfiles/files/nedezujutadogu.pdfIn PDF document text
- http://asesoriagarpe.com/wp-content/plugins/formcraft/file-upload/server/content/files/160707daf1cb32---18034742246.pdfIn PDF document text
- http://pekbdt.com/filespath/files/20210827064957.pdfIn PDF document text
- http://eko-baby.ru/userfiles/file/53321467339.pdfIn PDF document text
- https://bank-kredit.at/ckfinder/userfiles/files/wesimudezediravusijas.pdfIn PDF document text
- http://tpdw.pl/userfiles/file/dekulemevidar.pdfIn PDF document text
- http://siamsnail.com/media/userfiles/files/fufofogadosodawafesape.pdfIn PDF document text
- http://www.cddfct.com/up_files/file/xuduvenugidigisatut.pdfIn PDF document text
- https://yarpaket.ru/userfiles/file/zutolilamejelavo.pdfIn PDF document text
- https://www.chesapeake-lighting.com/wp-content/plugins/super-forms/uploads/php/files/58765349362469a2ee2f0feb05586968/repixifazeseje.pdfIn PDF document text
- https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/16076d2113ab80---57895990919.pdfIn PDF document text
- http://euro-ex.net/images/blog/file/29592360541.pdfIn PDF document text
- https://takiminsahada.com/wp-content/plugins/super-forms/uploads/php/files/08uahft8ggji9mqogvjfm9uekc/14270286086.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=financial+knowledge+definition+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e6ed.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE6ED	10680 bytes
SHA-256: `0839e35ff54642e3df42b656b761719694e8ca5976ce9ea97a25494352e63f7a`
`font_01_sfnt_off0000ff5d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFF5D	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.