PDF malware analysis — malicious · 1898863f83fee99a

MALICIOUS

PDF

95.7 KB Created: 2021-06-27 00:00:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23

MD5: 503e110d0bb3b28f1e8eb9a03d7e5f2f SHA-1: cdec0db7c7d672aec0168875257e07216eae16dc SHA-256: 1898863f83fee99a3d2e49f999ce08cdc5dfc160117d0e8149993836e0cc3473

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The file contains a link farm pointing to compromised CMS upload storage, suggesting an attempt to redirect users to malicious content. The presence of numerous unknown URLs hosted on potentially compromised websites indicates a phishing or malware distribution campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.5902

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://smarttactic.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607df3d25b1d7---dewuzexelugujabi.pdf In PDF document text
- http://www.melodypods.com/wp-content/plugins/formcraft/file-upload/server/content/files/160893c77c65a0---biworozimitiza.pdfIn PDF document text
- http://fixafilm.se/userfiles/file/30081153971.pdfIn PDF document text
- http://amctop.com/board_data/editor_img/file/202105212045.pdfIn PDF document text
- https://popa.com.br/wp-content/plugins/super-forms/uploads/php/files/4a435ed18e015df07d32af06c85e85ce/9307158220.pdfIn PDF document text
- https://www.scanworld.se/wp-content/plugins/formcraft/file-upload/server/content/files/160a736f6cb9ab---pinufexujupulotodobige.pdfIn PDF document text
- http://osullivanspressurewashing.com/wp-content/plugins/formcraft/file-upload/server/content/files/160871f9a74191---76327691338.pdfIn PDF document text
- http://ahdongjiu.com/upload_fck/file/2021-6-25/20210625130540508831.pdfIn PDF document text
- http://coffee33.ru/archive/file/zobis.pdfIn PDF document text
- https://299-45.com/CKEdit/upload/files/48398849719.pdfIn PDF document text
- https://rescue.bg/wp-content/plugins/formcraft/file-upload/server/content/files/1608e2c4362850---pejif.pdfIn PDF document text
- http://commune-bourre.com/userfiles/file/61689059250.pdfIn PDF document text
- https://www.hotelamoha.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607cc466b1476---xoboruxuvugul.pdfIn PDF document text
- http://matstravel.ru/userfiles/file/4857825152.pdfIn PDF document text
- https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/498f78d1a5886a5189a9789f49cfe81f/27997630247.pdfIn PDF document text
- http://firewheels.pe/userfiles/file/89410917776.pdfIn PDF document text
- https://kudamatsu.org/userfiles/file/69583576709.pdfIn PDF document text
- https://ivanamihic.com//files/7098548003.pdfIn PDF document text
- https://3dreamvr.com/wp-content/plugins/super-forms/uploads/php/files/ff5ddcb4da659ad1ad7aace1adc440cd/20171342426.pdfIn PDF document text
- https://voolabs.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b7fc515c7df---risejaramegisedudi.pdfIn PDF document text
- https://alperbehang.nl/userfiles/file/42241093438.pdfIn PDF document text
- https://www.themeshcowork.com/wp-content/plugins/super-forms/uploads/php/files/a9ff6b755c1b88b47c6f5781eb2c2082/nagolanetemoponere.pdfIn PDF document text
- http://cetinelektrik.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1607e25a1830b5---37930320838.pdfIn PDF document text
- http://aitrans.org/UploadFile/file/F1202105140958107409.pdfIn PDF document text
- http://slowjamsundays.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089e0461bc70---zapubij.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=meaning+of+mariam+in+arabicPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fb16.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFB16	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off00011328.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11328	21004 bytes
SHA-256: `1a5bcbea91689a65aeed45f755218f3ed7b2c01ac8c78686083b0a16eb9c39f4`
`font_02_sfnt_off00014891.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14891	16948 bytes
SHA-256: `cc6f56e6fe5e64633c67d46f25d92cb5f7e442e132471a51407a8abb3aaf670a`
`font_03_sfnt_off0001612d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1612D	10500 bytes
SHA-256: `6d1a532077574ad41cd6920acebc490555903a8209a4be7fc007637c48500172`

Open this report in the interactive analyzer, or submit your own file for analysis.