PDF malware analysis — malicious · 3d96ce5e21b27157

MALICIOUS

PDF

80.1 KB Created: 2021-09-03 10:04:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05

MD5: b8004e5091fb920e5b44137022a6941a SHA-1: bf8249e214640bed01549547d6d13440cc13362e SHA-256: 3d96ce5e21b27157fe5db464a4526cf6d4be1aaedb6ad17022df90f2fb0fd1ec

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged as malicious by a machine learning classifier and ClamAV. It contains numerous links, many pointing to compromised CMS upload storage or disposable hosting, indicating it functions as a link farm. The primary goal appears to be directing users to external, potentially malicious websites.

Machine Learning

Nyx PDF Classifier malicious score 0.9949

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://savvyais.com/userfiles/file/vijitajemuzuxegam.pdf In PDF document text
- http://vasilii-orlov.fun/wp-content/plugins/super-forms/uploads/php/files/f6b951670e5ad1f7a9cd516784edeae9/fukezadoxesete.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607658168804a---87154212285.pdfIn PDF document text
- https://bedandbreakfastchia.it/userfiles/file/zekepufaze.pdfIn PDF document text
- http://profesniprukaz.cz/ckfinder/userfiles/files/zapek.pdfIn PDF document text
- http://mouaumfb.com/wp-content/plugins/formcraft/file-upload/server/content/files/160709097c4080---98611466856.pdfIn PDF document text
- https://www.funes.gob.ar/ckfinder/userfiles/files/10238440192.pdfIn PDF document text
- https://beautifulhairstore.com/upload/files/zirilebeno.pdfIn PDF document text
- https://mangonebike.com/uploads/file/vavulozuvexoxafisosixoz.pdfIn PDF document text
- http://domplus.su/userfiles/files/90859684948.pdfIn PDF document text
- https://daleplumbinginc.com/wp-content/plugins/super-forms/uploads/php/files/5d88d7b7b6ddde783755c8823f1142c1/38765007203.pdfIn PDF document text
- https://polskieplytki.com/wp-content/plugins/super-forms/uploads/php/files/9cb6b4cbe0e96fb0468941bc7dca8359/38652609612.pdfIn PDF document text
- http://srihemkuntsahibfgp.org/hemkunt/userfiles/file/vutaxutuvariwuved.pdfIn PDF document text
- http://goldenbaycruisesagent.com/userfiles/file/noxajunetezibililutamowit.pdfIn PDF document text
- https://cananalimdar.com/wp-content/plugins/super-forms/uploads/php/files/fnoupgmoerk216572gpssi3ahg/riwupeg.pdfIn PDF document text
- https://nuevocoach.co.uk/wp-content/plugins/super-forms/uploads/php/files/c1b18cdafe0a40557f61719ae5ad76bc/14888372404.pdfIn PDF document text
- https://trucraftsmanship.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c8c2d49c343---kamutulugogopij.pdfIn PDF document text
- http://chagatea.ru/wp-content/plugins/super-forms/uploads/php/files/af478cd5ab5ba9d2af3d7c21be5c07bd/6525015539.pdfIn PDF document text
- https://www.adom.biz.pl/ckfinder/userfiles/files/17151892394.pdfIn PDF document text
- https://hmv.ir/wp-content/plugins/formcraft/file-upload/server/content/files/160851be22703b---2344920715.pdfIn PDF document text
- http://oreade-breche.fr/userfiles/file/xezarefiramekasal.pdfIn PDF document text
- https://ontime-taxi.kg/wp-content/plugins/super-forms/uploads/php/files/e206cdde8ce8a9b1e29d94baf9024810/nirewanami.pdfIn PDF document text
- http://bioaec.com/userfiles/files/wuxowijafinekepake.pdfIn PDF document text
- http://veronicanealhome.com/wp-content/plugins/formcraft/file-upload/server/content/files/2/160885e6861045---bopeda.pdfIn PDF document text
- http://travellerisland.com/files/zafoxusafugonuvedo.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3CAf4wW3hvY/uplcv?utm_term=2008+subaru+forester+xt+manual+for+salePDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d5a5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD5A5	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000edbc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEDBC	10980 bytes
SHA-256: `f6af039cc72e082e60f6aa533ac19b668d131c7c07ca222945b9ed655f8ee50b`
`font_02_sfnt_off0001074a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1074A	16600 bytes
SHA-256: `17378599852d27e3d3f7811e79317635404e6a574638562cb1f0f65bca2a5388`

Open this report in the interactive analyzer, or submit your own file for analysis.