PDF malware analysis — malicious · 2726aed4ff5f1159

MALICIOUS

PDF

89.1 KB Created: 2021-09-03 22:34:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12

MD5: 5e075bc4fc2d2d7bc114c8f21465d4a1 SHA-1: 70f02a6971616edda11c9672443799e26601ce40 SHA-256: 2726aed4ff5f1159a36faa81fa7160e0c45a901887036380b8ebc81f7ca81994

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected as malicious by ClamAV and an ML classifier, and exhibits characteristics of a link farm pointing to compromised websites. Several heuristics indicate the PDF contains numerous links, with some hosted on disposable domains or compromised CMS uploads, suggesting a phishing or malware distribution lure. No scripts were extracted, but the overall structure and URL findings point to a malicious intent to redirect users.

Machine Learning

Nyx PDF Classifier malicious score 0.9835

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://brandonsmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/gadlqh5oh1s4q6b6lj80m5m893/fipoxajejiriko.pdf In PDF document text
- https://floresdeserrezuela.com/aym_image/files/lanexewodiwixevejukujexin.pdfIn PDF document text
- https://gym-rectif.fr/ckfinder/userfiles/files/10647212663.pdfIn PDF document text
- http://geredekombiservisi.com/userfiles/file/bixovowozimevek.pdfIn PDF document text
- http://quartierdete.fr/uploads/fckeditor/file/80427100939.pdfIn PDF document text
- https://ans5680.preneed91.com/upload/files/44123209665.pdfIn PDF document text
- http://staging.impactredevelopment.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609e7236aa4e6---38466328982.pdfIn PDF document text
- https://popcouncilinstitute.org/wp-content/plugins/super-forms/uploads/php/files/8701597055a3589b38cc3116b1a17789/4621267834.pdfIn PDF document text
- http://wakingbeauty.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a5d45e5716---40987709083.pdfIn PDF document text
- https://www.taxiserviceh24.com/wp-content/plugins/formcraft/file-upload/server/content/files/160888f105ffff---81501305854.pdfIn PDF document text
- http://www.sg-callenberg.de/wp-content/plugins/formcraft/file-upload/server/content/files/16094285e20fbc---31246084054.pdfIn PDF document text
- https://renetravel.ro/images/files/8655624349.pdfIn PDF document text
- http://abwlanham.com/uploads/files/verozomumizaferuruveli.pdfIn PDF document text
- http://hodinovysoused.cz/upload/file/8184434598.pdfIn PDF document text
- http://ttlengenharia.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16081ca7cbeb5f---lolatetiluku.pdfIn PDF document text
- http://alkanboya.com/files/file///kiwijizipikimebonekag.pdfIn PDF document text
- https://relaxationplusmn.com/wp-content/plugins/super-forms/uploads/php/files/5c90bb2bd0afd0f68b9c71d59ee13fa7/56314018434.pdfIn PDF document text
- http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c724f55d7c0---15205697347.pdfIn PDF document text
- http://www.homefacelifters.com/wp-content/plugins/super-forms/uploads/php/files/a0c21279508dcb4423bcaff382a5b068/27417585759.pdfIn PDF document text
- http://centrons.com/uploaded/file/107852235960d3861d5c214.pdfIn PDF document text
- http://deccanquest.com/konadnew/userfiles/file/ronusezawawuv.pdfIn PDF document text
- https://www.chartsunlimited.com.ph/wp-content/plugins/formcraft/file-upload/server/content/files/1609ed8dd43740---72343714073.pdfIn PDF document text
- http://nutricion-intravenosa.com/wp-content/plugins/super-forms/uploads/php/files/87ddb0baea6e8c986674047fea93a025/5805994142.pdfIn PDF document text
- http://abc-tel.ru/data/File/69024041970.pdfIn PDF document text
- https://micast.de/wp-content/plugins/super-forms/uploads/php/files/litqaool3da01i2g8odf2o3dfj/debisoza.pdfIn PDF document text
- http://midel.me/userfiles/file/83676034220.pdfIn PDF document text
- https://www.pal-kont.hu/wp-content/plugins/super-forms/uploads/php/files/94ca0848b67d72eda0573176ee31332c/kagutubafagowu.pdfIn PDF document text
- http://www.primalegal.eu/wp-content/plugins/super-forms/uploads/php/files/6701et7fjcm3k2mpepk5bbuqk7/18454113488.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/zMnd8XtcwSM/uplcv?utm_term=tabela+periodica+em+pdf+downloadPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f18e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF18E	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off000109a5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x109A5	10704 bytes
SHA-256: `d093fddd45d98186e25739ccbd2a5171b8522578fcfcf19d0bda831730d099d7`
`font_02_sfnt_off000121fb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x121FB	20260 bytes
SHA-256: `e8d11cd28eec3c2125512d82dcdc62deef11f518bb12212f42339ae4ab5895a3`

Open this report in the interactive analyzer, or submit your own file for analysis.