PDF malware analysis — malicious · 307a0e085d8a0dd2

MALICIOUS

PDF

210.4 KB Created: 2021-07-01 00:34:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-31

MD5: 7e4d9b939518cb87cf8fa55a08062cc5 SHA-1: 16f14e6ada96bd522deb7d4ca07ad48cdaf5a304 SHA-256: 307a0e085d8a0dd2e35f67b913432078851ca6131d51d47cc544ad1ac0c2826a

166 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of multiple URLs hosted on compromised CMS upload directories suggests an attempt to distribute further malicious content. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely contains instructions to open a password-protected archive, a common tactic to bypass gateway security.

Machine Learning

Nyx PDF Classifier malicious score 0.9868

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://catamma.ru/uplcv?utm_term=indus+valley+civilisation+meaning PDF link annotation
- https://www.hintonassociates.com/wp-content/plugins/super-forms/uploads/php/files/7f82783991db7a111d59559317653539/95218922518.pdfIn PDF document text
- http://www.studiolegalefusimorelli.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073becd5c559---31629322969.pdfIn PDF document text
- https://vpntraffic.com/upload/files/zasenonelokilunedut.pdfIn PDF document text
- https://www.grandeprairie.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607fed7e99d95---vetusenilugunusep.pdfIn PDF document text
- http://suportti.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b8c28520b0---85570918428.pdfIn PDF document text
- https://hitpoint.tw/userfiles/file/menibexo.pdfIn PDF document text
- https://bbensonmft.com/wp-content/plugins/super-forms/uploads/php/files/d9639d2576732ee0df0f77411721b602/48933453818.pdfIn PDF document text
- https://tenfci.org/userfiles/file/21251663455.pdfIn PDF document text
- http://www.aluvascientific.com/UserFiles/file/14219258479.pdfIn PDF document text
- http://mko-yug.ru/wp-content/plugins/super-forms/uploads/php/files/431ed0b0e376c7b8f29136ef7192f1fa/pokizoxejuvokita.pdfIn PDF document text
- http://grani-tonkogo-mira.ru/wp-content/plugins/super-forms/uploads/php/files/022032900c9ffb3eab86095c3207072c/62348495836.pdfIn PDF document text
- https://www.cdscabling.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160a537dfdeb0c---43586784015.pdfIn PDF document text
- https://capitalsyndic.com/userfiles/file/mekiwe.pdfIn PDF document text
- http://aj-logistics.com/stock/userfiles/file/34659966367.pdfIn PDF document text
- http://xperion.hu/wp-content/plugins/super-forms/uploads/php/files/158f9634b69479b55c23b2bba156d725/vovomatuguzevupegubup.pdfIn PDF document text
- https://purpleleafestatebuyers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ca6ca1cc78---98206104226.pdfIn PDF document text
- https://kisikana.hr/userfiles/file/91333872951.pdfIn PDF document text
- http://davidhammerstein.org/userfiles/file/mezejofapi.pdfIn PDF document text
- https://trucraftsmanship.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a4a6e59e36---kajegorijorakevudabutev.pdfIn PDF document text
- https://amirep.com/wp-content/plugins/super-forms/uploads/php/files/ac8582fedea565f329dc16ddfb4dd732/pevizipunasolugi.pdfIn PDF document text
- http://cukiernia-waltar.pl/qcms/userfiles/file/tirowolaporalofisevez.pdfIn PDF document text
- http://chemonova.com/FCKeditor/file/wekenafexivalesetej.pdfIn PDF document text
- http://lovewhereyoulv.wpengine.com/wp-content/plugins/super-forms/uploads/php/files/dfa80dfee9669a91c8b483c54fb62769/93539088869.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0002d657.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2D657	10844 bytes
SHA-256: `ed42a998da43d64dc4fac864937c571f1da7c6144a56289ca7e1de54c3b6ea73`
`font_01_sfnt_off0002ef35.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2EF35	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00030747.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x30747	20644 bytes
SHA-256: `4b24433c45a89cf8ad27099908eef611f6eecf42dabf1907476e1008e78dd2ec`

Open this report in the interactive analyzer, or submit your own file for analysis.