PDF malware analysis — malicious · 07cb71bad2e841f8

MALICIOUS

PDF

72.4 KB Created: 2021-09-29 06:57:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25

MD5: e640432f6edc1960fb886096291fc706 SHA-1: a014523ccad21e06c89573d8796db2290f4d3eb9 SHA-256: 07cb71bad2e841f8a6953c2fc59b7992d6fb35f699d277429929884033e86fc1

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many of which are hosted on compromised CMS platforms or disposable domains, indicating a link farm designed to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent, likely for phishing or malware distribution. No scripts were extracted, but the overall structure and URL patterns suggest a phishing or downloader attack.

Machine Learning

Nyx PDF Classifier suspicious score 0.4585

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nomylo.ru/uplcv?utm_term=download+lucky+patcher+for+score+hero PDF link annotation
- http://sudeoksa.com/userfiles/file/20210906030515.pdfIn PDF document text
- https://kuzeyilac.com/resimler/files/kabimepaduxusod.pdfIn PDF document text
- http://www.dadosefatos.net.br/wp-content/plugins/formcraft/file-upload/server/content/files/16153c9f8b5df1---97386858913.pdfIn PDF document text
- https://www.advids.co/wp-content/plugins/formcraft/file-upload/server/content/files/161425e4b42086---977428187.pdfIn PDF document text
- http://studioguagnoni.it/userfiles/files/92850233494.pdfIn PDF document text
- http://studiogallerani.it/userfiles/files/54573421747.pdfIn PDF document text
- http://mellorymotors.ru/admin/ckfinder/userfiles/files/95297571462.pdfIn PDF document text
- http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615118a3a29cc---notazanojovapiwotuvan.pdfIn PDF document text
- http://gimnazjum-krasiczyn.pl/img/userfiles/file/14426159780.pdfIn PDF document text
- https://vinocastillo.hu/editor_up/52917306002.pdfIn PDF document text
- http://minisadik-margaritka.ru/admin/ckfinder/userfiles/files/luxajisavo.pdfIn PDF document text
- http://sts-logistika.ru/wp-content/plugins/super-forms/uploads/php/files/cfb4d4bdf38d0ac55008b17d7b5eadfd/turemu.pdfIn PDF document text
- http://kimhoatra.com/upload/fckimagesfile/63134304197.pdfIn PDF document text
- https://ceccarmaramures.ro/userfiles/file/22220532633.pdfIn PDF document text
- http://www.leesii.com/wp-content/plugins/formcraft/file-upload/server/content/files/161431b87e5fc2---xakonowuv.pdfIn PDF document text
- http://fmi.lu/userfiles/files/sewetibudomawujalilagi.pdfIn PDF document text
- http://nieruchomosci-swidnica.pl/userfiles/file/28165288335.pdfIn PDF document text
- https://relaxationplusmn.com/wp-content/plugins/super-forms/uploads/php/files/32486a664d65b59b31adc851755f1e8b/26996823779.pdfIn PDF document text
- http://canphantich.net/Images_upload/files/32927041763.pdfIn PDF document text
- http://www.benyowsky.com/resources/files/tevobutegowiletu.pdfIn PDF document text
- http://heryeryesil.com/resimlerfiles/rogiwikelufamukumese.pdfIn PDF document text
- http://timebymtm.com/upload/files/18811695691.pdfIn PDF document text
- http://studioesflores.pl/obrazy/file/3203601979.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000bc86.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBC86	19572 bytes
SHA-256: `8247fadc49bd99a0cb475a614a7e691b1fdfa38404e97364ea20902ab751a531`
`font_01_sfnt_off0000ef79.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEF79	11020 bytes
SHA-256: `7710ee3298b3062d9c2e2a6773333ef3b7a8497088c23006fe8daa4965290e94`
`font_02_sfnt_off0001092f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1092F	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.