PDF malware analysis — malicious · 1aecd0171ef6473a

MALICIOUS

PDF

86.7 KB Created: 2021-06-30 20:36:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20

MD5: 004521b37b15b146ecacf283c2053bf0 SHA-1: b54125a21e31457af26059bc0223ce165a970f92 SHA-256: 1aecd0171ef6473ae72b786d7c9c53d1c72abe6c18a58f8f2cee10f2cc187e29

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. The document functions as a link farm, containing numerous URLs pointing to compromised CMS uploads and disposable hosting, likely intended to redirect users to malicious content. The presence of multiple external URIs and a link farm structure suggests an attempt to distribute malware or phish for credentials.

Machine Learning

Nyx PDF Classifier malicious score 0.9848

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://glotecgh.com/upload/editor/file/13287737961.pdf In PDF document text
- http://giasuthienphuc.com/Images_upload/files/funusajix.pdfIn PDF document text
- https://wacee.net/wp-content/plugins/formcraft/file-upload/server/content/files/160cd7ead5f0fd---10331030091.pdfIn PDF document text
- https://www.ptlittleflower.org/wp-content/plugins/super-forms/uploads/php/files/nik1cpa67tq491qi4jh99c7ui2/59103360058.pdfIn PDF document text
- http://learningkey.org/userfiles/laxerikovum.pdfIn PDF document text
- http://kfbi.ru/content/file/wuvikobifojot.pdfIn PDF document text
- http://donateagift.eu/userfiles/file/kowawop.pdfIn PDF document text
- http://skogsformedling.se/bilder_umeny/File/kopopujikigegasexerifenad.pdfIn PDF document text
- https://mls.lighting/wp-content/plugins/super-forms/uploads/php/files/0385914bc62c3163b2f24ad073ddc596/26673180299.pdfIn PDF document text
- http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a220bde29ac---58146320809.pdfIn PDF document text
- http://kystop.com/wp-content/plugins/super-forms/uploads/php/files/ikkagcbtf0a4k3qggm0msouto1/37558847049.pdfIn PDF document text
- https://lepjunk12.hu/uploads/files/sisizidulen.pdfIn PDF document text
- https://deewo.de/wp-content/plugins/formcraft/file-upload/server/content/files/160757159d33c3---saxakimebivo.pdfIn PDF document text
- http://daotaonhaccong.com/uploads/userfiles/file/67727124098.pdfIn PDF document text
- https://acethamessecurity.co.uk/wp-content/plugins/super-forms/uploads/php/files/397e88e7c9cd8f2ad477283a75709f08/38512364805.pdfIn PDF document text
- https://webgirls-studio.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079da60e6aa9---58815639359.pdfIn PDF document text
- http://www.kliningstroy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16077834aeb982---91571794787.pdfIn PDF document text
- https://accesoriosalmayor.com/images/userfiles/file/fegaxiliz.pdfIn PDF document text
- http://xahscw.com/userfiles/file/mutasoreneduwatirirubu.pdfIn PDF document text
- https://asiatravel.kg/wp-content/plugins/super-forms/uploads/php/files/4159bba8d09f8fe45d1af002268ddd7a/73291640183.pdfIn PDF document text
- https://www.cdscabling.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1607afa8372391---vopijijukujume.pdfIn PDF document text
- http://lamekatus.ee/uploads/ckeditor/files/dowatutizumiwifinuloxele.pdfIn PDF document text
- https://lastcallslc.com/wp-content/plugins/super-forms/uploads/php/files/feb59d239f8f34b1604d68504899cccb/36482660897.pdfIn PDF document text
- https://vidolamerica.org/wp-content/plugins/super-forms/uploads/php/files/130a3c06b1f6e33079f20ebed0ec7b22/20934405887.pdfIn PDF document text
- http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b470225de1a---73311586163.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=evs+questions+for+ctet+paper+1PDF link annotation
- http://lovewhereyoulv.wpengine.com/wp-content/plugins/super-forms/uploads/php/files/07df840106bfe6c3b2c8d007459ebd18/sedojedidusabukaxuzirese.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f00c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF00C	10776 bytes
SHA-256: `e1608a0a955d253514e8c0ef991a07434d21407fdcc3a4dc1f90b4277dc3a775`
`font_01_sfnt_off00010911.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10911	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00012123.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12123	16988 bytes
SHA-256: `ecb708a65669605e3948608fcf320a6be20ab2242732b8c7c0eb67f76c21769b`

Open this report in the interactive analyzer, or submit your own file for analysis.