PDF malware analysis — malicious · 1a41b730c1a3a11f

MALICIOUS

PDF

86.9 KB Created: 2021-07-15 19:20:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11

MD5: 675d55bbcd0159db5844e06a4cc47825 SHA-1: 5ef982e16b147d1ef43e152dcdce4ed115d0c452 SHA-256: 1a41b730c1a3a11f0a2154d431f823794f67b7f3c924bc1a3e01980d2760b169

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains a link farm that directs users to multiple compromised WordPress sites hosting further PDF files. This behavior is indicative of a phishing or malware distribution campaign, likely initiated via spearphishing. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.9848

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://bodwellassociates.com/wp-content/plugins/super-forms/uploads/php/files/a0a094a1160d8db1b8e830917f88a1ae/43872611493.pdf In PDF document text
- http://metallpress.info/files/87611920165.pdfIn PDF document text
- https://advancedbusiness.co/wp-content/plugins/super-forms/uploads/php/files/26952ef65b8734e64bf7b56a6119b698/bazomaxilaki.pdfIn PDF document text
- https://atolab.it/wp-content/plugins/super-forms/uploads/php/files/3f76c4dbab9a760ae07cb0b066da79f8/sofewoxexu.pdfIn PDF document text
- http://argyler.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607715d36221b---wufofibudafukepoximo.pdfIn PDF document text
- http://www.lugashotel.com/data/editorfile/47042178283.pdfIn PDF document text
- http://moreit.ch/productinfo/file/72856523884.pdfIn PDF document text
- https://noble-worldwide.com/wp-content/plugins/super-forms/uploads/php/files/022eca0099027c3aca02eecf8a75bbea/48264657921.pdfIn PDF document text
- http://banhangcongnghe.com/upload/FCK/file/65317679951.pdfIn PDF document text
- http://www.consorcio.edu.pe/wp-content/plugins/formcraft/file-upload/server/content/files/160765cdeaab11---wugumavakonezebebe.pdfIn PDF document text
- https://101doctor.com/uploads/ckfiles/files/60b7c82616091.pdfIn PDF document text
- http://ottotech.center/userfiles/file/2599596755.pdfIn PDF document text
- http://bulk-supplies.com/userfiles/file/37658302166.pdfIn PDF document text
- https://sweetestspaparty.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081a1b7162f9---razetol.pdfIn PDF document text
- https://www.endthestigmacounselling.com/wp-content/plugins/super-forms/uploads/php/files/rr0bp50v59ok38httpgpdiintc/80350692067.pdfIn PDF document text
- https://evermoral.hk/upload/file/1625602888.pdfIn PDF document text
- https://ohcsi.com/ckfinder/userfiles/files/vakusitifuzijagoxakegafod.pdfIn PDF document text
- https://www.aserspa.net/wp-content/plugins/super-forms/uploads/php/files/5lvgvtd88okuo6qvohamkg9v37/5293538325.pdfIn PDF document text
- https://makemycake.gr/wp-content/plugins/super-forms/uploads/php/files/7jh7p4jht3vn8q5m1rgbm0179n/59412657357.pdfIn PDF document text
- http://bygreenpure.com/userfiles/file/78285504520.pdfIn PDF document text
- http://elenasteele.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a9e44c3108e---juvurakokopikibuxejo.pdfIn PDF document text
- http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160987d13abab8---bawonenawajukepunut.pdfIn PDF document text
- http://autosklo.sk/pictures/file/bemepexelakofisowinin.pdfIn PDF document text
- https://balance-global.com/wp-content/plugins/super-forms/uploads/php/files/6hd36ra1c82g0lqpor1kc6u7fd/92679785006.pdfIn PDF document text
- https://havadisname.com/upload/ckfinder/files/91794381947.pdfIn PDF document text
- https://nuevocoach.co.uk/wp-content/plugins/super-forms/uploads/php/files/db0d26275e19f48e7493fe714deda06d/34424475994.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=into+the+wild+end+quotePDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f4c3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF4C3	16596 bytes
SHA-256: `b6c5302ac47dca53d44a06bf0c21ef4a46e074e4a50113c4203c4302fba06c72`
`font_01_sfnt_off00011f89.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11F89	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off000137a0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x137A0	10200 bytes
SHA-256: `e062e8ab54c5a1352c909ab3fa3c489fc515890eda747763faad739cd4a37240`

Open this report in the interactive analyzer, or submit your own file for analysis.