PDF malware analysis — malicious · 27ae180155e8cb06

MALICIOUS

PDF

78.4 KB Created: 2021-07-08 07:36:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26

MD5: bd385dfcda8dd6681c3a0dffc6289607 SHA-1: 8a730eef9438f14af8498797238e293721df61f9 SHA-256: 27ae180155e8cb06f56d98f03ddd1a99c8b8b06f023f2bd0d96f422e625cfeba

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links pointing to compromised WordPress sites and disposable hosting, suggesting a link farm used to obscure the ultimate destination. The presence of these links and the overall structure strongly indicate a phishing or malware distribution campaign, likely initiated via spearphishing.

Machine Learning

Nyx PDF Classifier malicious score 0.7019

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://estigotours.com/wp-content/plugins/super-forms/uploads/php/files/7ffe4f798e059446019d940c3ed6c38c/bafinalaberujujar.pdf In PDF document text
- https://law.com.sg/wp-content/plugins/super-forms/uploads/php/files/39c1d7e8bb6dbc5486244d08f68bdf1f/88036475897.pdfIn PDF document text
- https://www.reliancecareuk.com/wp-content/plugins/super-forms/uploads/php/files/30b68aa0198f383f2529b460c6b7fc98/98638705457.pdfIn PDF document text
- http://dalboncostruzioni.it/userfiles/files/60218654270.pdfIn PDF document text
- http://structurecreative.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b23a408e05e---83560238107.pdfIn PDF document text
- https://anmimar.com/royal/userfiles/file/49283163219.pdfIn PDF document text
- https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/744857d984d574d60d03b55d8df255c8/gowevakedudejit.pdfIn PDF document text
- https://cbolean.com/wp-content/plugins/super-forms/uploads/php/files/a6kecng4suqmqdhbcjvmb9dp64/50595949457.pdfIn PDF document text
- http://www.lbf-cosmetics.com/website/wp-content/plugins/formcraft/file-upload/server/content/files/1607a513a13b2d---66391941899.pdfIn PDF document text
- http://sun-eko.eu/files/file/vowodesubonewuj.pdfIn PDF document text
- https://arvikabc.com/images/uploadedimages/file/saxiwizonimufujopajowisu.pdfIn PDF document text
- https://event-connections.net/wp-content/plugins/formcraft/file-upload/server/content/files/160a8331a70305---rivelurepexuza.pdfIn PDF document text
- https://www.fecomerciomg.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/16072d68557c6e---95065726391.pdfIn PDF document text
- http://jeugdopdewetenschapsagenda.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1606d34882a3e5---44854553188.pdfIn PDF document text
- https://www.kiteschule-kiel.de/wp-content/plugins/formcraft/file-upload/server/content/files/160715c45006f6---96104305818.pdfIn PDF document text
- http://rydelko.pl/userfiles/file/49113898907.pdfIn PDF document text
- https://www.infratechgroep.nl/wp-content/plugins/super-forms/uploads/php/files/65c38269362a82dee197c1ba90e367e4/66691569222.pdfIn PDF document text
- http://strandedtattoo.net/file/fowoxifomefikeja.pdfIn PDF document text
- http://www.deewanalarab.com/up_imgs/45950504466.pdfIn PDF document text
- http://www.sg-callenberg.de/wp-content/plugins/formcraft/file-upload/server/content/files/16094571040a1b---82749128969.pdfIn PDF document text
- http://allegroescrow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609bcfc4c18cd---55657466976.pdfIn PDF document text
- https://www.avenueroadadvertising.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084ad4a5a6f3---72991380852.pdfIn PDF document text
- http://midiabyz.com/wp-content/plugins/super-forms/uploads/php/files/24575683b3981cc9f7e92138ae3ea401/28426755794.pdfIn PDF document text
- http://www.lauricedale.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160772bfa46ee4---bujijikadapexafox.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=splicing+in+protein+synthesisPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000db69.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDB69	16732 bytes
SHA-256: `ac346ca9579787ac2536f966f9c75660f3b49852eed41162b391c0a57dffe439`
`font_01_sfnt_off0001065f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1065F	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00011e76.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11E76	10680 bytes
SHA-256: `84ee21a89ff27738f9b94e8139e9f7152b1a252a70acb9c10d96d0b8e0553ba3`

Open this report in the interactive analyzer, or submit your own file for analysis.