PDF malware analysis — malicious · 2561f48928515b25

MALICIOUS

PDF

77.9 KB Created: 2021-06-28 05:32:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-15

MD5: 77b48a99cf0bcf1b7f06ef0d4454b0f5 SHA-1: b2ab683297f2264a8728cf72a4ae379fbe9d76c1 SHA-256: 2561f48928515b25d80343ffed0c09199aeb23b92e4e56bb4de308960a64cf71

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs pointing to various domains, many of which appear to be compromised WordPress sites used for hosting malicious files. The 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM' heuristics indicate a pattern of using disposable hosting and compromised CMS uploads to distribute content. ClamAV detection and ML classification further support its malicious nature, likely as a phishing or malware distribution lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9943

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://smidgel.ru/uplcv?utm_term=low+systolic+bp PDF link annotation
- https://rebates.forex/wp-content/plugins/super-forms/uploads/php/files/ir51egsrd33a2qqvqopsdcsbh5/rajejofejuwado.pdfIn PDF document text
- http://www.maoles.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a4964709967---8310534999.pdfIn PDF document text
- http://www.rlktechniek.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a78c0367d45---4168671934.pdfIn PDF document text
- https://weddingitaly.jp/images/file/jesolabuvomavelitisokimib.pdfIn PDF document text
- https://inclinedigital.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b3ab3d7c3fb---78511010990.pdfIn PDF document text
- http://bagpack.com.np/wp-content/plugins/formcraft/file-upload/server/content/files/1607deb17d5fe0---zuretabuluneduzi.pdfIn PDF document text
- http://bright-mineral.com/uploadfile/file/2021061015292089.pdfIn PDF document text
- https://expungemyrecordnj.com/wp-content/plugins/formcraft/file-upload/server/content/files/160863ef43c6fd---kupasurujikakosozoxigot.pdfIn PDF document text
- http://www.cheapmotorcycleinsurancepa.com/wp-content/plugins/super-forms/uploads/php/files/h8h038u2d5jrjuqk8q3rbb5lg7/soxaketotalikux.pdfIn PDF document text
- http://fapannimario.it/userfiles/files/rifekanujelax.pdfIn PDF document text
- https://www.karavanlakesfet.com/wp-content/plugins/super-forms/uploads/php/files/bc293f134b63dfcf6a030e0c627d1ad2/tagotatotudikab.pdfIn PDF document text
- https://otdelkamos.ru/wp-content/plugins/super-forms/uploads/php/files/3955df58d0a36d8e9a007885dd2afa74/kutuzipur.pdfIn PDF document text
- https://centar-znr-zop.hr/wp-content/plugins/formcraft/file-upload/server/content/files/1607b02ee3ae77---dakob.pdfIn PDF document text
- https://harpethvalleypto.org/wp-content/plugins/super-forms/uploads/php/files/d64d65b443975e95086acfdf9ee9869d/85094743519.pdfIn PDF document text
- http://mhinflatable.com/upload/file/sanovuboxo.pdfIn PDF document text
- http://ecandrychow.pl/Image/files/24697972744.pdfIn PDF document text
- https://www.wflorlando.com/wp-content/plugins/super-forms/uploads/php/files/1b40e641ee3c830272393529bf08062f/77729650176.pdfIn PDF document text
- https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/12c0330bd241af8a34754872c3071200/kakaje.pdfIn PDF document text
- https://drrajanmahtani.com/userfiles/files/46977548505.pdfIn PDF document text
- https://a2designbg.com/userfiles/file/setij.pdfIn PDF document text
- https://husvagnsexpo.se/wp-content/plugins/formcraft/file-upload/server/content/files/16086a92749cbe---3642053450.pdfIn PDF document text
- https://alismobile.co.uk/wp-content/plugins/super-forms/uploads/php/files/38f68c5bbb0ed9062c05a21f4f5b8f9c/86223899366.pdfIn PDF document text
- http://hattrick-sports.com/wp-content/plugins/formcraft/file-upload/server/content/files/160733a6044d9d---manekiveboxevanet.pdfIn PDF document text
- https://clubforeducation.com/FCKeditor/userfiles/file/nasofekijowegapov.pdfIn PDF document text
- https://www.aironface.com/wp-content/plugins/super-forms/uploads/php/files/a8dcd50203b78eb95529c7446164817d/40843006483.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d2f3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD2F3	15856 bytes
SHA-256: `df75de81f87493cbaa2cace7857e1637f01b0027490405ebf2a86907cf174b90`
`font_01_sfnt_off0000fbd0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFBD0	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off000113e7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x113E7	10164 bytes
SHA-256: `3eee851891a29ea78a5532e471e01f213bf3f32260c537eb792065703baf98a8`

Open this report in the interactive analyzer, or submit your own file for analysis.