PDF malware analysis — malicious · 091251db1ce76e55

MALICIOUS

PDF

99.2 KB Created: 2021-09-02 04:34:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07

MD5: d69a7330a3d808a76a44a8fab02200f8 SHA-1: b6820adf02545155ee94624e1af9e802883918db SHA-256: 091251db1ce76e5521a2a1a09bf3d219c8271df8ce0a1a641c1942b4871e2e58

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains a large number of links, many of which point to compromised WordPress sites hosting other PDF files. This structure is indicative of a link farm designed to obscure the ultimate destination, likely a phishing page or a malware download server. The ML classifier and ClamAV detection strongly support its malicious nature, classifying it as a phishing trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.9909

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://viaterrestre.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1612c6773d1d86---movelizisopojubapotukekim.pdf In PDF document text
- http://bagandpack.ru/wp-content/plugins/super-forms/uploads/php/files/743df6544200b1000408bc8b7796a210/37793002216.pdfIn PDF document text
- https://fieldofgreen.com/wp-content/plugins/super-forms/uploads/php/files/b19e0f9e727d3376d87033197ba8de19/34993701822.pdfIn PDF document text
- http://www.xpresswedding.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089f6c9843c6---77281226101.pdfIn PDF document text
- https://www.dentaltaxpros.com/wp-content/plugins/super-forms/uploads/php/files/90e7f12c120412f079f115dd012d7a81/11821201514.pdfIn PDF document text
- http://churchtextile.com/userfiles/file/wowenaboxuzi.pdfIn PDF document text
- http://homenet-spb.ru/userfiles/file/dividomosaveronalo.pdfIn PDF document text
- https://wilsonbarrera.com/inicio/wp-content/plugins/formcraft/file-upload/server/content/files/161200bedd0fc1---fanapijefe.pdfIn PDF document text
- https://cristiandellavedova.com/wp-content/plugins/super-forms/uploads/php/files/gkn84jttdrboqfaevdfmei2n05/3214563309.pdfIn PDF document text
- http://auapp.ch/userfiles/files/gawusodiroxagapifogoremiz.pdfIn PDF document text
- https://lllk.ru/wp-content/plugins/super-forms/uploads/php/files/2be41a95ea97398db4603650c0b79eb7/sexapovasofujuxipojepemit.pdfIn PDF document text
- https://catherinehourihan.art/wp-content/plugins/super-forms/uploads/php/files/c31a48f1078b554cc0a660b47d0d3a64/kesada.pdfIn PDF document text
- https://condominiovillage.com/userfiles/file/33947733231.pdfIn PDF document text
- http://www.drop-lok.com/wp-content/plugins/formcraft/file-upload/server/content/files/160de04d434b66---40376768940.pdfIn PDF document text
- https://sthouseluxury.com/upload/files/92564008748.pdfIn PDF document text
- https://meganimal.pt/site/upload/file/fuzil.pdfIn PDF document text
- https://www.superioreagle.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ce93b2e538---70846320424.pdfIn PDF document text
- https://abandassociates.com/ckfinder/userfiles/files/zebelafipixazusu.pdfIn PDF document text
- http://fallsplat.se/file/6900404486.pdfIn PDF document text
- http://teleinwestor.pl/userfiles/file/wawirilegarasexafu.pdfIn PDF document text
- http://smclassof57.org/clients/34860/File/5674895988.pdfIn PDF document text
- https://yourtuscanyguide.com/wp-content/plugins/super-forms/uploads/php/files/digvjftbb4r63vj1jclccaubf1/vodikumegoragepapu.pdfIn PDF document text
- http://bestorkate.com/uploads/ckeditor/files/91848185839.pdfIn PDF document text
- https://www.duffylighting.com/wp-content/plugins/super-forms/uploads/php/files/97d72b9cf99432daf9caebdd516b5ae1/mupikexaguduzatuje.pdfIn PDF document text
- https://iwanbim.com/userfiles/files/34131792523.pdfIn PDF document text
- http://aeskulap24h.de/wp-content/plugins/formcraft/file-upload/server/content/files/160bf9c5ce0694---99615120693.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/BkSY9tpko7c/uplcv?utm_term=according+to+the+bible+jesus+was+born+inPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00011c98.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11C98	18620 bytes
SHA-256: `1c864830dcc8a4b34979999b082765bdd29a53c79db48a9e90206e6439ca86b4`
`font_01_sfnt_off00014c1a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14C1A	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00016431.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x16431	11088 bytes
SHA-256: `18c7679423f0a95d485f400c3d09dc519556ef9b459aabff648009a036e80dc8`

Open this report in the interactive analyzer, or submit your own file for analysis.