PDF malware analysis — malicious · 18ecba9fe78f6fce

MALICIOUS

PDF

78.7 KB Created: 2021-07-21 16:58:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14

MD5: 13ec221273e1a7b0a5bcb0f48e49af7d SHA-1: 1acbd7c92fec22e18523b1ef2e08dbf5ba67fb19 SHA-256: 18ecba9fe78f6fcea6282e52d07391f673d3b53df2fd007d7505bb81479d4fcc

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It functions as a link farm, containing numerous URLs pointing to potentially compromised websites or disposable hosting. The primary purpose appears to be redirecting users to malicious content, leveraging a technique often associated with phishing campaigns.

Machine Learning

Nyx PDF Classifier malicious score 0.9917

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://shaplaconsulting.com/app/webroot/ckfinder/userfiles/files/xeputakedu.pdf In PDF document text
- https://www.energetisch-therapeut-estie.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1606f3cb5e3389---fawivalodoliputa.pdfIn PDF document text
- https://anctools.com/ckfinder/userfiles/files/rigepuxodapivup.pdfIn PDF document text
- http://opalbiosciences.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079a47047c02---welujogetinurizemumoj.pdfIn PDF document text
- https://smoothnomad.com/wp-content/plugins/super-forms/uploads/php/files/j45jhlvt8fvt5tuab2ajj43gb7/11458093496.pdfIn PDF document text
- https://petikdaun.com/contents//files/69283648992.pdfIn PDF document text
- http://whs1979.net/clients/65916/File/98374243253.pdfIn PDF document text
- https://salubrismd.com/wp-content/plugins/super-forms/uploads/php/files/019b22432853f9f940a5d30f3577b741/38976270859.pdfIn PDF document text
- http://sad-azov.ru/wp-content/plugins/super-forms/uploads/php/files/cf3335a2af8c6fe1639d599d95d391d8/55374761922.pdfIn PDF document text
- https://www.adelaarenergy.com/wp-content/plugins/super-forms/uploads/php/files/t5825la83vaq5bp5c4nk9s852d/63662360631.pdfIn PDF document text
- https://miamiuniquelimo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c9804a6f44---50685694954.pdfIn PDF document text
- https://www.ayersworthglen.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e9e5aa2d27---35174611782.pdfIn PDF document text
- http://abapaposentados.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16090e69861ec6---kuraromigekisogoj.pdfIn PDF document text
- https://rffsev.ru/wp-content/plugins/super-forms/uploads/php/files/405558f747225a425da79faafe55d3b1/guvatemenup.pdfIn PDF document text
- http://www.oschouston.com/osc/wp-content/plugins/formcraft/file-upload/server/content/files/160a01c4f4e09c---laruravawefoxafevazono.pdfIn PDF document text
- https://heritagelogs.com/wp-content/plugins/super-forms/uploads/php/files/1kgm7dgfuuk5us6j59enl5i0lu/60366393390.pdfIn PDF document text
- http://www.altrus.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16098ae54417ed---mojobavunoke.pdfIn PDF document text
- https://svetpoznaniyaonline.ru/wp-content/plugins/super-forms/uploads/php/files/cc61fae4335e052b7e662dab4814ca79/vegoju.pdfIn PDF document text
- https://ariaparvaz.com/basefile/ariaparvazcom/files/33294173497.pdfIn PDF document text
- http://mauchlineware.com/html/chapelstreet/web/userfiles/files/botamipawovife.pdfIn PDF document text
- http://birnagarcollege.in/userfiles/file/sovabobikaxozufi.pdfIn PDF document text
- https://zevkotodoseme.com/upload/ckfinder/files/41077570267.pdfIn PDF document text
- https://alves.bg/ckfinder/userfiles/files/lejuwipekejosuve.pdfIn PDF document text
- https://ohligschlaeger-berger.de/wp-content/plugins/formcraft/file-upload/server/content/files/16087a0118a7f3---33181496195.pdfIn PDF document text
- http://mineraux-et-lithotherapie.fr/ckeditor/upload/files/87257025472.pdfIn PDF document text
- http://www.belladermeestetica.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16088713381627---39217551342.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BvfzZFkJO3s/uplcv?utm_term=hip+hop+word+searchPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d1b1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD1B1	10440 bytes
SHA-256: `782e5845aac1bb94354aaa9e0868e368de0cd3671ce14ae5e75babed9250d0ef`
`font_01_sfnt_off0000e989.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE989	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off0001019b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1019B	16828 bytes
SHA-256: `fe748c92ec40bbb714b2213ce1c01ffde6e8a64c2800f3196dfd94b2b313b038`

Open this report in the interactive analyzer, or submit your own file for analysis.