PDF malware analysis — malicious · 42625a449aadba9c

MALICIOUS

PDF

84.3 KB Created: 2021-07-16 22:53:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11

MD5: a207a71a783dc2a5ec7ba13d3c5ee047 SHA-1: 09b0372b7a3401f5a6185540fa22fec0a9402683 SHA-256: 42625a449aadba9c38f491abea9408c7e29f09c9aa935143c33e55abd5a1914a

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, with multiple heuristics indicating it functions as a link farm hosted on compromised WordPress sites. The embedded URLs, such as http://www.rlktechniek.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607f5980962df---31603816789.pdf, are likely used to redirect users to malicious content. The presence of external URIs and link farm characteristics suggests a phishing or malware distribution attempt, aligning with the Spearphishing Attachment technique.

Machine Learning

Nyx PDF Classifier malicious score 0.9951

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.rlktechniek.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607f5980962df---31603816789.pdf In PDF document text
- http://kindervakantieweekdeurne.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c6b6740e523---34473259209.pdfIn PDF document text
- http://axwelindia.com/uploads/42647234464.pdfIn PDF document text
- https://tlpnw.com/wp-content/plugins/super-forms/uploads/php/files/48a6c1fc5cef9b1884ea48abf747c494/1727588776.pdfIn PDF document text
- https://schreinerheusi.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a2f5a356dfa---serexoninodasoni.pdfIn PDF document text
- http://berbun.com/user_img/file/kobomasawiramewixumepoj.pdfIn PDF document text
- https://elbag.net/wp-content/plugins/super-forms/uploads/php/files/a12aef7e3013a8880ae7ac00db260d09/37166378615.pdfIn PDF document text
- https://www.digitalsofts.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a88ece5ab27---baruzipuzanidasusisizi.pdfIn PDF document text
- https://www.hotelamoha.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607d66c670c6a---raxafofikizuzazopexuv.pdfIn PDF document text
- https://www.sussexweddingservices.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1607589dc79f85---17035874933.pdfIn PDF document text
- http://ctyrkolky-gamax.cz/data/dokumenty/10809994737.pdfIn PDF document text
- https://ifacemount.com/wp-content/plugins/super-forms/uploads/php/files/psnp0pit9o2f60dl0q4g9ao7c9/basafaj.pdfIn PDF document text
- https://him-home.ru/wp-content/plugins/super-forms/uploads/php/files/d07af64c5a061d52ada9b1345e23fd80/7980395245.pdfIn PDF document text
- https://vansuloi.com/uploads/userfiles/file/bavuzoxonomujilinotugoro.pdfIn PDF document text
- http://lookupagency.es/wp-content/plugins/formcraft/file-upload/server/content/files/160ab54fc15f62---52469921010.pdfIn PDF document text
- https://ivanamihic.com//files/vagupe.pdfIn PDF document text
- https://homini.eu/wp-content/plugins/formcraft/file-upload/server/content/files/1606df60362b34---dixodipajagalak.pdfIn PDF document text
- http://feach.ie/images/uploads/file/1651910117.pdfIn PDF document text
- https://cananalimdar.com/wp-content/plugins/super-forms/uploads/php/files/j4ndtqu95nmt2b9bdkup0mgldd/derapajaxeg.pdfIn PDF document text
- http://www.iycadana.org/wp-content/plugins/super-forms/uploads/php/files/1i0aavc4klvhcss8iu09j7fjc7/netipuxesaso.pdfIn PDF document text
- http://graphicon.hu/wp-content/plugins/formcraft/file-upload/server/content/files/1606d63565e71f---40832522833.pdfIn PDF document text
- http://www.awakohchang.com/image/upload/File/7424523322.pdfIn PDF document text
- https://lienlacanien.com/img_pages/file/34298730027.pdfIn PDF document text
- http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/1606c93aa88e44---jobipuwemoge.pdfIn PDF document text
- http://andlupa.com/userfiles/file/66400084567.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/1KS0DP0cxss/uplcv?utm_term=parts+of+the+arm+and+handPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e9dc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE9DC	16484 bytes
SHA-256: `4c3f6992c21d194103bcb4faee6f5efe52a277806192d55cd2f98241e69d577f`
`font_01_sfnt_off00011478.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11478	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00012c8f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12C8F	10484 bytes
SHA-256: `fc0755f50cd2324db1a148e4fdfc1599066ec10e4d4ece0e64f9600a58aa8797`

Open this report in the interactive analyzer, or submit your own file for analysis.