PDF malware analysis — malicious · 0d282d2755368afc

MALICIOUS

PDF

82.9 KB Created: 2021-09-08 06:55:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07

MD5: 1dabd9b55c00b9125fe80a9bf8218180 SHA-1: e3d3af502960de7a764bd5595853756a4802a836 SHA-256: 0d282d2755368afceff2446b3121ef815b6de4ca11e29d6d56b6155a41fa3423

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, many of which point to compromised WordPress sites or disposable hosting, indicating a link farm designed to distribute malicious content or phish users. The ClamAV detection and ML classifier strongly suggest malicious intent, aligning with a phishing or malware distribution campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.9917

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://kolesnikov.pro/ckfinder/userfiles/files/37898452841.pdf In PDF document text
- http://edison76.com/clients/5/54/54c13950cbd15a81e6fb4362eab8f273/File/26379717308.pdfIn PDF document text
- https://btegypt.com/file/xijubujexig.pdfIn PDF document text
- http://www.ibadirect.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb9481b9421---97648974556.pdfIn PDF document text
- http://rittenhousereunion.com/clients/a/ad/ad7d26974070b67854a29702aed78614/File/50433444473.pdfIn PDF document text
- http://iphonedown.com/ckfinder/userfiles/files/winupumi.pdfIn PDF document text
- https://www.kiteschule-kiel.de/wp-content/plugins/formcraft/file-upload/server/content/files/16091ca554a17b---72238082124.pdfIn PDF document text
- https://junona.manyel.website/images/uploads/medium/39172007918.pdfIn PDF document text
- http://poaglasses.com/uploads/files/202108220254292316.pdfIn PDF document text
- http://celiapopememorial.com/clients/4/45/45605e685ba8a3b32f56966823665796/File/98587848476.pdfIn PDF document text
- http://accapierre.it/userfiles/files/bazoxojipisuxamukim.pdfIn PDF document text
- http://atsrealtyvietnam.com/upload/files/gipoxa.pdfIn PDF document text
- http://aberdeeneyes.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606c9c74e01aa---2850837683.pdfIn PDF document text
- https://gaseg.com/wp-content/plugins/super-forms/uploads/php/files/8juu3tas4jcuf6hr5jurt2lgci/88179383215.pdfIn PDF document text
- https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081f91f200e9---52988887639.pdfIn PDF document text
- https://socohoteldanang.com/uploads/image/files/pubuluwuvesepafogi.pdfIn PDF document text
- https://ganport.pl/userfiles/file/suxowijezig.pdfIn PDF document text
- https://jagamimpi.com/contents/files/finevetisenevud.pdfIn PDF document text
- http://visualpaint.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b6b0d1c9569---76021979913.pdfIn PDF document text
- http://udokutscher.de/gfx/userfiles/files/tasedulejosobale.pdfIn PDF document text
- http://maxgear.cz/webpagebuilder/ckfinder/userfiles/files/97000966765.pdfIn PDF document text
- http://graciaindoutama.com/kingkong/userfiles/files/karudafamopubaxumetiwab.pdfIn PDF document text
- http://z-sinpro.com/upload/files/pimirisewolaxoror.pdfIn PDF document text
- http://blessedfamilycovenant.org/clients/c/cb/cb727bc273eb4203dc66fb73741ae5ae/File/madazekon.pdfIn PDF document text
- https://edu-mate.kr/_UploadFile/Images/file/49358835123.pdfIn PDF document text
- http://studiotecnicodavico.eu/userfiles/files/xuduvinataza.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/S30rS-6n6vg/uplcv?utm_term=dmv+driver%27s+manual+pdf+njPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000df0b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDF0B	17496 bytes
SHA-256: `d81fb09829e22dec5e9fe85ad485e9a28c29f26e430eccf6aea07642d6e1ac58`
`font_01_sfnt_off00010cae.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10CAE	10772 bytes
SHA-256: `6f9ee794e3da4ce297f2ecee94c5f5f43bcc8d09ef2f0d0441a414ae9fe67595`
`font_02_sfnt_off00012571.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12571	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.