PDF malware analysis — malicious · 25f912fbb425ede7

MALICIOUS

PDF

79.0 KB Created: 2021-06-22 21:55:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: 2df5957546c221bafde9d023ad39b3d4 SHA-1: d297430abdb5d7bac2f207b3e5fd87b064ab7ec5 SHA-256: 25f912fbb425ede7ef59f0961ebd14e76eb3c9e6e30ddf61f0663a7d183f8ecc

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was identified as malicious by a machine learning classifier and ClamAV, indicating a phishing or trojan threat. It functions as a link farm, containing numerous URLs pointing to compromised CMS uploads and disposable hosting, likely to distribute further malicious content or phish for credentials. The presence of multiple external URIs and a link farm structure strongly suggests an attempt to redirect users to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9823

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://agilitynd.com/wp-content/plugins/super-forms/uploads/php/files/f978c83d20973c704cda077fc4c9f9a0/63513965834.pdf In PDF document text
- http://greenbrier101.com/userimages/98267277137.pdfIn PDF document text
- https://yssnewlessons.org/UserFilesTwo/file/nuropadas.pdfIn PDF document text
- http://bochosushi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607585c4a4cb7---ponusexametori.pdfIn PDF document text
- http://www.onegelha.com/wp-content/plugins/super-forms/uploads/php/files/c50e491253ca3da4bb6733072661244d/rejukebugoma.pdfIn PDF document text
- https://heykidsletscook.info/wp-content/plugins/super-forms/uploads/php/files/358d13b6d90525c8e6924bb7817f70fb/soloxarasakedododemotala.pdfIn PDF document text
- https://t4g.nasscomfoundation.org/wp-content/plugins/super-forms/uploads/php/files/do7s1s1f89ep3gnnoq7odv9g34/xabovegixomadupelewasaweb.pdfIn PDF document text
- https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/fd12hkq3od6d3j3lergv3f9j3d/pisebuxezedaselow.pdfIn PDF document text
- http://bukhatirhomes.com/userfiles/file/72287260438.pdfIn PDF document text
- http://www.thunderesp.com/ckfinder/ckfinder.htmlfiles/47703392247.pdfIn PDF document text
- https://remoteworkerclub.com/wp-content/plugins/super-forms/uploads/php/files/9ecb9975719983c67e63ce0fcd09c273/riwepobizimogibesagaze.pdfIn PDF document text
- http://americasbestmanassas.com/uploads/files/21399625401.pdfIn PDF document text
- https://peterdegendt.be/file/42631549164.pdfIn PDF document text
- http://www.hptindia.com/wp-content/plugins/formcraft/file-upload/server/content/files/160af8d075ff14---37969042523.pdfIn PDF document text
- http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089c57fd7d91---55134714616.pdfIn PDF document text
- https://binarbaidservices.com/public_html/userfiles/file/68342716872.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=deciduous+forest+abiotic+factorsPDF link annotation
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eb1a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB1A	5120 bytes
SHA-256: `a4d4edd1c2ed2ef200ca0378bb370ce3a6102e64aa6be211dcc2726dfdedc52f`
`font_01_sfnt_off0000fc94.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFC94	11312 bytes
SHA-256: `3d5aa746e278619f9f1cef2014f5422e0aa3042e30fc475af542f647338028a2`
`font_02_sfnt_off000121d5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x121D5	16204 bytes
SHA-256: `532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e`

Open this report in the interactive analyzer, or submit your own file for analysis.