PDF malware analysis — malicious · 456f17d346fd4b0b

MALICIOUS

PDF

89.9 KB Created: 2021-08-03 01:30:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14

MD5: 0d71e2460de10dbfacd8132d47e733e3 SHA-1: e269757c15d086c8803be975c7c36c4742da5a45 SHA-256: 456f17d346fd4b0bb4bf52f69a89922e68621b56f3afff0647f6ba1789987f69

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as a phishing trojan by ClamAV and flagged by an ML classifier. It contains a link farm pointing to compromised WordPress upload storage and other disposable hosting, suggesting an attempt to redirect users to malicious content. The embedded URLs and link farm structure indicate a phishing or malware distribution attempt, likely disguised as a software download.

Machine Learning

Nyx PDF Classifier malicious score 0.9942

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pirkitpadangas.lt/ckfinder/userfiles/files/8353404637.pdf In PDF document text
- http://garantc.ru/userfiles/file/7689595642.pdfIn PDF document text
- https://atlasautoglass.com/wp-content/plugins/formcraft/file-upload/server/content/files/160828729e301a---jekerejo.pdfIn PDF document text
- http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160c91fc3d104c---29316923558.pdfIn PDF document text
- https://aquaticlandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609af63e72c55---98554664117.pdfIn PDF document text
- http://progfin.pl/userfiles/file/fozanurapevibimalexutu.pdfIn PDF document text
- http://akcjonariusz.com/UserFiles/file/fibumuxilin.pdfIn PDF document text
- http://intechsol.kz/wp-content/plugins/formcraft/file-upload/server/content/files/160994ac5eea9a---dipanurukisekazedudida.pdfIn PDF document text
- https://refour.eu/wp-content/plugins/super-forms/uploads/php/files/9c83f6e4e0c033f09c74dbf9039949d9/26624418745.pdfIn PDF document text
- https://www.kadeavenue.com/wp-content/plugins/super-forms/uploads/php/files/c1be7dfd4bb61dba76663d65227c07cb/3755601813.pdfIn PDF document text
- https://www.fifatravels.com/wp-content/plugins/formcraft/file-upload/server/content/files/160940fd78c4e1---12240672303.pdfIn PDF document text
- https://bizdrive.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/160b1b0e79d1e0---lipeguxemotilenaxigosimig.pdfIn PDF document text
- https://landlorddebtadvisory.com/wp-content/plugins/super-forms/uploads/php/files/b8229p81u54p6l4j3gkdm90kl5/bilukawejek.pdfIn PDF document text
- https://local-atlas.ru/userfiles/files/kokav.pdfIn PDF document text
- http://psychanalyste-gard.fr/ckfinder/userfiles/files/wajisemilifijerinu.pdfIn PDF document text
- https://hoffmanowska.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1608f986c02b43---38871818534.pdfIn PDF document text
- https://wendi101.com/userfiles/file/numeteloxosimawu.pdfIn PDF document text
- https://www.temsilcisitesi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c30bc659fd---vedulixunemar.pdfIn PDF document text
- http://hk-dcc.com/wp-content/plugins/super-forms/uploads/php/files/lj22er1t1sf2eocq9hj6ffqp4g/gesaw.pdfIn PDF document text
- https://amd-export.com/site/upload/file/5399698430.pdfIn PDF document text
- https://funkydrop.shop/wp-content/plugins/super-forms/uploads/php/files/62038e337ced2e468e1e6239166044a0/10213699086.pdfIn PDF document text
- http://ar-intl.net/wp-content/plugins/super-forms/uploads/php/files/alhpl3pjc190kn35esl2oukoa0/xukoxifagow.pdfIn PDF document text
- http://2girlstrippin.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ee0be44e149---912693659.pdfIn PDF document text
- https://scavilecis.it/userfiles/file/48188423234.pdfIn PDF document text
- https://baodinhsolar.com/wp-content/plugins/super-forms/uploads/php/files/jv5snc5lhsusengg6sl3c8lkd7/65704606342.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/BvfzZFkJO3s/uplcv?utm_term=spotify+download+ios+14PDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fdad.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFDAD	10664 bytes
SHA-256: `79da542c63e09a8760347bf753c8ec8c8033682b246bf2c0c6e988d9b84b6c1f`
`font_01_sfnt_off0001165f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1165F	16976 bytes
SHA-256: `d636f959b36a04b38359b014c2ccc0a96f898cee2f98c99ba876513858ebace7`
`font_02_sfnt_off00014238.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14238	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.