PDF malware analysis — malicious · 03aea02334314454

MALICIOUS

PDF

76.7 KB Created: 2021-09-05 01:12:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16

MD5: 834e6b698ae4bc7957dca012cd4ba56b SHA-1: 2553593f54d607b610fcc86936b751ca4669d54a SHA-256: 03aea02334314454a5e3902082a15da187d3d1dd7e333e8cd8ae3b2d9951cb8e

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The file contains numerous external URIs and is identified as a link farm hosted on potentially compromised CMS upload storage. The primary attack pattern involves directing users to external URLs, such as the one found at 'https://pixomot.ru/uplcv?utm_term=panduan+budidaya+kelapa+sawit+pdf', which likely serves as a lure for phishing or further malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9943

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pixomot.ru/uplcv?utm_term=panduan+budidaya+kelapa+sawit+pdf PDF link annotation
- https://hohsingfiber.com/ufiles/files/dilosovekavefub.pdfIn PDF document text
- https://chataigne-cevennes.fr/imgs/files/zuwoputevowedawerod.pdfIn PDF document text
- https://ohligschlaeger-berger.de/wp-content/plugins/formcraft/file-upload/server/content/files/160b3a251468c0---78579833101.pdfIn PDF document text
- http://cz-synergy.cz/data/file/94188799384.pdfIn PDF document text
- http://nedirajtebosnu.net/userfiles/file/9156407770.pdfIn PDF document text
- http://cuatro-pr.org/sites/default/files/file/jadopujatazipipesufabal.pdfIn PDF document text
- https://www.modianodesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/160806c3ae5d71---rozipuvagupedisafar.pdfIn PDF document text
- http://bukharageorgia.com/sites/default/files/file/71467175716.pdfIn PDF document text
- https://automatisme-portail-bordazzi.fr/userfiles/fichiers/52256593688.pdfIn PDF document text
- https://pluviaterra.mx/wp-content/plugins/super-forms/uploads/php/files/4c0f285951b473cd51a12e8e2ed9bdac/weralukezimuzukasoseto.pdfIn PDF document text
- http://wakingbeauty.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a7d6e5568f9---sofagenalojufoge.pdfIn PDF document text
- http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/6h9255mp3c743402r91o1g1394/18778195517.pdfIn PDF document text
- https://ntct.dz/ckfinder/userfiles/files/13004316447.pdfIn PDF document text
- https://inlandautorepairmurrietaca.com/wp-content/plugins/super-forms/uploads/php/files/c68ef645f2796b6c7b85ddb405a2e5a1/wovadolokikabifekowupe.pdfIn PDF document text
- http://stmrcstvm.com/userfiles/file/kegute.pdfIn PDF document text
- http://heninrealty.com/userfiles/files/xexanewazopibutowuwitoge.pdfIn PDF document text
- http://classtool.info/upload/files/20131922193.pdfIn PDF document text
- https://petroblend.com/wp-content/plugins/formcraft/file-upload/server/content/files/161256c63beeff---53691197179.pdfIn PDF document text
- http://www.yourhealthyourchoice.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607fe60d6604f---69985213798.pdfIn PDF document text
- http://pansophers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d9c75d3610e---zibijifagef.pdfIn PDF document text
- http://melissajacksonmd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160871821e6981---pojowolawejenibuwagufizev.pdfIn PDF document text
- http://www.cheapmotorcycleinsurancepa.com/wp-content/plugins/super-forms/uploads/php/files/0b0sideko66td226jgmmjvdj04/67563041478.pdfIn PDF document text
- https://protradingindia.net/userfiles/file/fujosavisomizuli.pdfIn PDF document text
- http://www.justgiveahand.org/wp-content/plugins/formcraft/file-upload/server/content/files/16079ffcf80568---fuvoxilurepiburud.pdfIn PDF document text
- http://kioskcondoweb.wpengine.com/wp-content/plugins/formcraft/file-upload/server/content/files/160dad0c9cf62d---6713107354.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c7e7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC7E7	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000dff9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDFF9	17276 bytes
SHA-256: `7ccd02b1bf0198fdf17b49b28eb76d9ea9a65e58b834073af777e195fcb61b8b`
`font_02_sfnt_off00010c67.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10C67	10804 bytes
SHA-256: `e9f9b51d07f511009dac4b0afffe8c97c7589cff70ec8483586182acf90a27be`

Open this report in the interactive analyzer, or submit your own file for analysis.