PDF malware analysis — malicious · 1897475b3ab1971e

MALICIOUS

PDF

87.3 KB Created: 2021-09-08 10:21:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23

MD5: 6fbb86950424ca2ad786c2a8dc9fb5e5 SHA-1: 43c76527d73595f6cadcc2c086f0c5a51a0f676c SHA-256: 1897475b3ab1971e9c4f4af45a29dcf2a1e4a80b55e183e44c38026e11794a9c

196 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristics reveal it functions as a link farm, pointing to numerous compromised websites and potentially disposable hosting, suggesting a phishing or scam lure. The 'SE_PASSWORD_ARCHIVE_LURE' heuristic indicates a common tactic to bypass gateway scanning by instructing the user to decrypt a payload, further supporting a malicious purpose.

Machine Learning

Nyx PDF Classifier malicious score 0.9973

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/ccd5bda7d4db3dd1011591a9c5e511de/83639276579.pdf In PDF document text
- https://khonggiansangtao.com/platformecom/img/upload/file/tuguzajinunepi.pdfIn PDF document text
- https://fastcomputer.vn/wp-content/plugins/super-forms/uploads/php/files/297f643f5c62d7a49ae5b7c6d39e4208/59796104668.pdfIn PDF document text
- http://jrpst.pl/userfiles/file/vutetumagojafezigatuli.pdfIn PDF document text
- http://mdtrend.hu/files/file/17058831545.pdfIn PDF document text
- https://southtours.com/wp-content/plugins/super-forms/uploads/php/files/dc9e0leiur170m3uof22pj105i/pusobixidiv.pdfIn PDF document text
- https://queensflower.nl/clientfiles/67280140300.pdfIn PDF document text
- https://vpntraffic.com/upload/files/7921821069.pdfIn PDF document text
- http://caopump.com/admin/userfiles/file/33133062029.pdfIn PDF document text
- https://duel.pl/userfiles/file/20300728572.pdfIn PDF document text
- https://petikdaun.com/contents//files/zimesugirara.pdfIn PDF document text
- http://www.accessibilite-salle-eau.com/ckfinder/userfiles/files/58408923590.pdfIn PDF document text
- https://ncfouting.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608ee0a1dbf55---89940334578.pdfIn PDF document text
- https://psychotherapie-dr-albrecht.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606f00510c107---xarixomalerefuziruxorudor.pdfIn PDF document text
- https://sckstone.com/wp-content/plugins/super-forms/uploads/php/files/a4c5e11ed245060513af4abb8a7b5176/lumotetesepatiferaw.pdfIn PDF document text
- https://indikino.com/ckfinder/userfiles/files/7821823660.pdfIn PDF document text
- http://studiopedrazzini.eu/userfiles/files/12192748406.pdfIn PDF document text
- https://hosvagyok.hu/userfiles/file/18092550007.pdfIn PDF document text
- http://timnhanhonline.net/upload/files/japeguk.pdfIn PDF document text
- http://podlahypilat.cz/admin/file/3298577432.pdfIn PDF document text
- https://advancedcheckcashadvance.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ad3f1239887---zikejinemusafesovuvonom.pdfIn PDF document text
- http://kwik-it.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16082245b5fb00---27815063800.pdfIn PDF document text
- https://kvartira-zalog.ru/wp-content/plugins/super-forms/uploads/php/files/f21cd6a47b176bf85e5f49adf421642d/jegojosab.pdfIn PDF document text
- https://thealloywheelcentre.co.uk/wp-content/plugins/super-forms/uploads/php/files/9ce676fb2f0887791525c5561012e509/fevinovipexewoxejufedavo.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=omron+m3w+manualPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f120.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF120	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off00010932.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10932	18488 bytes
SHA-256: `2e9a02b021b64a5a6b863fc3b53ee9044a2b6dc80d24739a0968d573bf6bb178`
`font_02_sfnt_off000138c7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x138C7	10164 bytes
SHA-256: `2d455c9ff7cd6b0663afbefb329ef35d3f0e7dd18dfa54c3514b93bbfb41fb1f`

Open this report in the interactive analyzer, or submit your own file for analysis.