PDF malware analysis — malicious · 18d8e2b721e0de92

MALICIOUS

PDF

82.5 KB Created: 2021-08-16 11:54:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-31

MD5: ed967f496156ed60cd523edde89c3af7 SHA-1: 377e59c9250b2bfefeb731579fa53ea8730f99e2 SHA-256: 18d8e2b721e0de92b1802d66c636d44f319371e902201bb5e1ac1cbb6b2bf09d

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains numerous links, many pointing to compromised CMS uploads and disposable hosting, suggesting a link farm designed to redirect users to malicious sites. While no scripts were explicitly extracted, the PDF structure and link farm heuristics strongly suggest it's used as a lure for phishing or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9944

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.budgetskemaet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160977deddda76---noted.pdf In PDF document text
- https://bamfieldrental.com/userfiles/file/38668910311.pdfIn PDF document text
- http://clubselectionvoyages.net/images/file/39115752357.pdfIn PDF document text
- http://aeronautike.com/userfiles/file/bumikebir.pdfIn PDF document text
- http://www.sarajevo-inn-grunewald.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c9330ece8f---rivuvubijuzopazanitat.pdfIn PDF document text
- http://ecbpolska.pl/wp-content/plugins/super-forms/uploads/php/files/cfef1801a07471ae26bfb09fe5153668/31725507265.pdfIn PDF document text
- https://levin-dent.ru/wp-content/plugins/super-forms/uploads/php/files/92dc3e79e567f3acf4e15b79e584c3ad/wudawosazef.pdfIn PDF document text
- http://dytac.hk/userfiles/56870747014.pdfIn PDF document text
- https://turdv.ru/SITE/files/editor/file/49491599215.pdfIn PDF document text
- https://414movement.com/wp-content/plugins/super-forms/uploads/php/files/ba22e87561d5608c6527eb054570755f/raluxu.pdfIn PDF document text
- https://tavio.ru/files/file/kewarazi.pdfIn PDF document text
- https://windsbs.biz/files/file/29347667414.pdfIn PDF document text
- https://macauroommate.com/ckfinder/userfiles/files/79251660140.pdfIn PDF document text
- https://ladangmimpi.com/contents//files/96794149293.pdfIn PDF document text
- http://metzpaintings.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607adf8ac113f---dagirowimisuredalafigep.pdfIn PDF document text
- https://binarbaidfabrication.com/public_html/userfiles/file/pepibuvabevonaxoxam.pdfIn PDF document text
- http://www.orarestauratorisaf.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607294f4d713e---12749774481.pdfIn PDF document text
- http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/161193eafba3f0---rirolenefoge.pdfIn PDF document text
- http://queuemanagementsystems.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f81bb282170---62418650285.pdfIn PDF document text
- http://konditsionery-reutov.ru/upload_picture/file/21741105929.pdfIn PDF document text
- http://interel-rus.ru/test/sites/default/files/file/51331198658.pdfIn PDF document text
- https://sgdivorcelawyers.com/wp-content/plugins/super-forms/uploads/php/files/99f32686a9c5782b5fa1d57040166bdc/51294295416.pdfIn PDF document text
- https://office-agglo-larochelle.fr/userfiles/file/bomatadorefujuratejan.pdfIn PDF document text
- http://jfkanacon.org/data/userfiles/files/45138777173.pdfIn PDF document text
- http://au-coeur-du-temps.com/userfiles/file/terifanopinel.pdfIn PDF document text
- https://israelonthehouse.com/wp-content/plugins/formcraft/file-upload/server/content/files/160961bd7b7af8---ganonaxuropito.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/1KS0DP0cxss/uplcv?utm_term=ejercicios+de+sumas+restas+multiplicaciones+y+divisiones+para+cuarto+gradoPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dabc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDABC	17292 bytes
SHA-256: `3a58b0bccb7ea1a70bb94c37b39fc7f16648bfe509481715f84c0d9edb0e1ca8`
`font_01_sfnt_off000106c4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x106C4	11248 bytes
SHA-256: `ae5dcb690d03db7261289b4e126b5ebefd15ef26f5787471feaa1dc0955a2cb3`
`font_02_sfnt_off000120ef.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x120EF	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.