PDF malware analysis — malicious · 49e06180b10dcb8e

MALICIOUS

PDF

90.4 KB Created: 2021-06-29 16:04:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-13

MD5: 36a0782e85e94db6a55342154fba857f SHA-1: a24525cf16535457428dcf4d1410dbfc6b83b083 SHA-256: 49e06180b10dcb8ec1a83a5602b28ebcb16d533d4464be9fb8354ae2076ba14b

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links, many pointing to potentially compromised WordPress upload directories or disposable hosting, suggesting a link farm used to redirect users. The presence of external URIs and the overall structure point towards a phishing or malware distribution scheme.

Machine Learning

Nyx PDF Classifier malicious score 0.9822

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://carszana.com/image/upload/File/32608353244.pdf In PDF document text
- http://arablift.net/userfiles/file/fidawuvotokere.pdfIn PDF document text
- https://atamergranit.com/userfiles/file/defuvidapesowepelobawaruz.pdfIn PDF document text
- https://baconbites.com/wp-content/plugins/super-forms/uploads/php/files/ara6mipsfv2aiqg3rmdm3k9f84/duwemubi.pdfIn PDF document text
- http://extreamtuning.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16077d83387221---86409567153.pdfIn PDF document text
- https://k9-warrior.com/wp-content/plugins/super-forms/uploads/php/files/5kbq59un428t6pdjascml8vddg/36389765370.pdfIn PDF document text
- https://sabagdasarov.ru/upload/file/68523981938.pdfIn PDF document text
- https://revapackers.com/wp-content/plugins/super-forms/uploads/php/files/vo3mrjj099caoqhgv03s46j4u4/12948025588.pdfIn PDF document text
- http://www.meglobalinc.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160a5b1f8aa995---8974772300.pdfIn PDF document text
- http://hutergroup.de/userfiles/file/64264502602.pdfIn PDF document text
- https://havanic.com/cache/fck_files/file/nizorawajivugiduzipelox.pdfIn PDF document text
- https://www.histoiresdegroupes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e1767724e1---47645961131.pdfIn PDF document text
- http://www.kinoimaging.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1606ceb16869ce---52315035634.pdfIn PDF document text
- https://nicemexico.net/wp-content/plugins/formcraft/file-upload/server/content/files/160c3c38f70b46---wewile.pdfIn PDF document text
- http://baliretreatcenter.com/olabali_ci/media/images/newsfiles/75534155262.pdfIn PDF document text
- https://kogan-photo.ru/wp-content/plugins/super-forms/uploads/php/files/2062a66f369765d4ef6c504e584cebdf/jonovesutetudoledasesu.pdfIn PDF document text
- http://soft-pro.hr/upload/datoteke/33189317891.pdfIn PDF document text
- https://koffiewarenhuis.nl/app/webroot/files/userfiles/files/luzuzofivikineso.pdfIn PDF document text
- https://pyhm.ca/wp-content/plugins/super-forms/uploads/php/files/7s7m5q0as60gpfsu7hc5vhi8tm/13576643324.pdfIn PDF document text
- https://hmv.ir/wp-content/plugins/formcraft/file-upload/server/content/files/160998927ed1bc---wupopanamululalinise.pdfIn PDF document text
- https://414movement.com/wp-content/plugins/super-forms/uploads/php/files/16b317579f1b4b55c6761b244a9da5b3/28553237334.pdfIn PDF document text
- http://gerd-pollak.de/userfiles/file/26087767393.pdfIn PDF document text
- http://kaplanpm.com/wp-content/plugins/formcraft/file-upload/server/content/files/160775e5588a19---redopunewepegakovij.pdfIn PDF document text
- https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/9aff86be20322321ba1a55c18ec7ac29/wozimeminapupujunibiru.pdfIn PDF document text
- http://www.rkcomdesignservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b9ca0107a8---panetapetiz.pdfIn PDF document text
- http://heilpraxis-pankow.de/wp-content/plugins/formcraft/file-upload/server/content/files/160921d7a573cc---21207531084.pdfIn PDF document text
- http://kraljicabih.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077dba91c220---xolarojabazuja.pdfIn PDF document text
- http://www.fliesen-brill.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a846e3753ed---xuvigo.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=the+best+sex+ever+season+1PDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001007f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1007F	10388 bytes
SHA-256: `3befa4645b8c1bb2723692d52c92544aebaff274199f603dd5d44af96364b6d0`
`font_01_sfnt_off00011818.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11818	16872 bytes
SHA-256: `6ffa6e9c9ce6259954e61be11d9a2524fd380f2dbacfe1d890c4b3442c854ce6`
`font_02_sfnt_off0001441b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1441B	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.