PDF malware analysis — malicious · 4368be6c45e3ce24

MALICIOUS

PDF

91.8 KB Created: 2021-07-03 22:12:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-17

MD5: 2b58f510cf6aebf803a220196502b9d5 SHA-1: 3a5b9982321da0b790f3e5c7cbc8c3b99265c458 SHA-256: 4368be6c45e3ce2411f233b8728827fa1697b23f22f7eb14f5fcae9403de97fa

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It functions as a link farm, with numerous URLs pointing to compromised WordPress upload directories, suggesting an attempt to lure users to malicious content. The presence of multiple links on disposable hosting further supports a malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9835

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.frankreich-ferien.ch/wp-content/plugins/formcraft/file-upload/server/content/files/160cda0a739fdb---jaronikufaropepetekemed.pdf In PDF document text
- https://www.ediliziaindustriale.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072817de4fcc---2105990520.pdfIn PDF document text
- http://discoveryenglish.org/wp-content/plugins/formcraft/file-upload/server/content/files/160dfba5028ad9---46899473991.pdfIn PDF document text
- http://absigorta.com/E/file/36998393672.pdfIn PDF document text
- http://www.lavalledesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c338abf129---rorupizazawabupobapa.pdfIn PDF document text
- http://www.acefence.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b8b02118002---nabinanemojug.pdfIn PDF document text
- http://www.sempresaude.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b645d39bfbe---budegexetosazudop.pdfIn PDF document text
- https://goactive.hu/wp-content/plugins/super-forms/uploads/php/files/91ae32c31d486327578823636fa6a620/sidomolobok.pdfIn PDF document text
- http://famcareconnect.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607bacb6cd2d7---rewaborapelufetijiwojunow.pdfIn PDF document text
- https://akapacha.com/userfiles/file/86134685594.pdfIn PDF document text
- https://ecomassage.pt/wp-content/plugins/super-forms/uploads/php/files/v80p9su920lo4lnakjltkaf5dl/vexutujes.pdfIn PDF document text
- http://liebherr-tr.com/userfiles/file/fexizedoduvizo.pdfIn PDF document text
- http://willtorock.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c785abcf81---rusizozozazaxejoredodim.pdfIn PDF document text
- http://nhandieurangmuoi.com/ckfinder/userfiles/files/71196394149.pdfIn PDF document text
- http://erfolgsapp.de/wp-content/plugins/formcraft/file-upload/server/content/files/160895b779a1b0---41242932493.pdfIn PDF document text
- https://ehblending.com/wp-content/plugins/super-forms/uploads/php/files/ff01059f8935c6f682cf72be2b61b959/26302466128.pdfIn PDF document text
- http://clearlakesd.org/wp-content/plugins/formcraft/file-upload/server/content/files/160828e5ee7ec5---ribosadarixigopa.pdfIn PDF document text
- https://www.lamuccacompany.com/wp-content/plugins/super-forms/uploads/php/files/98d01c4c8b6d11718b625f15280fc49c/jowajesewimirisodup.pdfIn PDF document text
- http://stkvn.ru/wp-content/plugins/super-forms/uploads/php/files/2b1eb232049de58934f60ad271faa478/97750207342.pdfIn PDF document text
- http://starsunited.at/upload/files/zozewabekimaxam.pdfIn PDF document text
- https://www.tctnanotech.com/wp-content/plugins/super-forms/uploads/php/files/532442653581299bf14b876c6b52d760/27077933500.pdfIn PDF document text
- https://atlasautoglass.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c266b609a5---lesikozafoxirojuleg.pdfIn PDF document text
- https://relleno-acidohialuronico.com/wp-content/plugins/super-forms/uploads/php/files/66503308f69a9533498bbff952e37bcf/9425627576.pdfIn PDF document text
- http://dabaizhongxue.com/upload_fck/file/2021-5-16/20210516152550592542.pdfIn PDF document text
- http://bobiniauto.com/userfiles/file/xemavedepanaboxer.pdfIn PDF document text
- https://alternatifhirdavat.com/upload/ckfinder/files/letilexoburixorubada.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/zMnd8XtcwSM/uplcv?utm_term=french+revolution+romanticismPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010482.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10482	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off00011c99.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11C99	10636 bytes
SHA-256: `b4980cd4c2b28b751d808c24db6cec722ddbe391c4ad1bd19d42e4e0777255d3`
`font_02_sfnt_off000134b5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x134B5	17308 bytes
SHA-256: `645897ef46bba04fbdf5efc6842f7c79b769c932b1d33ac97fee3f3aad5c81a1`

Open this report in the interactive analyzer, or submit your own file for analysis.