PDF malware analysis — malicious · 5041e0203277469d

MALICIOUS

PDF

72.0 KB Created: 2021-08-30 05:46:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24

MD5: b0e610826176fd468aa8b2ed639ad8d4 SHA-1: de21dbce9d25f9d5e3621a8fea48f428b11ebd3b SHA-256: 5041e0203277469dd00f57affec6137cd62578315e5420bab543d06433b77e74

132 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample is a PDF containing embedded JavaScript, which is a common technique for executing malicious code. It also functions as a link farm, directing users to multiple external URLs hosted on potentially compromised WordPress sites. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports its malicious nature, indicating a phishing or trojan payload delivery attempt.

Machine Learning

Nyx PDF Classifier suspicious score 0.4301

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://amako-ra.com/wp-content/plugins/super-forms/uploads/php/files/5c13f2275cb919cfda669634e56f249f/wubulazobeviw.pdf In PDF document text
- http://airmon.hu/images/files/zugigin.pdfIn PDF document text
- http://purifoy2020.com/clients/1/11/118d8b7ee1ea4bab8fb19da95c56260f/File/32519007260.pdfIn PDF document text
- https://cottingham-group.com/cufiles/files/90984576736.pdfIn PDF document text
- https://forexinc.ca/upload/editor/file/95661471729.pdfIn PDF document text
- http://wakingbeauty.com/wp-content/plugins/formcraft/file-upload/server/content/files/160765ac51e06f---11507937740.pdfIn PDF document text
- http://classiccar-jp.com/js/upload/files/65219546823.pdfIn PDF document text
- https://oriontradecom.com/ckfinder/userfiles/files/22004099717.pdfIn PDF document text
- http://marty-triple-m.ch/inhalt/files/podufebafimetugeri.pdfIn PDF document text
- http://masan315.net/board/imagefile/file/33273187967.pdfIn PDF document text
- https://lion-trading.co.uk/wp-content/plugins/super-forms/uploads/php/files/grkeiolo05seph99e8hbt5e638/kupenab.pdfIn PDF document text
- http://ecogestval.com/userfiles/file/91101923913.pdfIn PDF document text
- http://haisushitogo.com/uploads/files/89654445443.pdfIn PDF document text
- https://dermatologie-francophone.com/userfiles/file/60678241882.pdfIn PDF document text
- http://xn--h49al33a2zdp0eo1x.com/DATA/file/20210808071032.pdfIn PDF document text
- http://www.celso.org/download/46452772835.pdfIn PDF document text
- http://moscow-vernisage.com/files/files/zafopedizubejuvedolozal.pdfIn PDF document text
- https://mosoptagro.ru/wp-content/plugins/super-forms/uploads/php/files/e04860482008823fa3604853ff648ef8/59483379344.pdfIn PDF document text
- http://atenngo.com/admin/sites/site/documents/mozegumemo.pdfIn PDF document text
- https://robertbah.si/files/file/dajitumegorabulogazi.pdfIn PDF document text
- https://hgb.se/filer/file/32285358404.pdfIn PDF document text
- http://diamondsnspurs.com/clients/12200/File/76894790286.pdfIn PDF document text
- https://adm.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/32c46d1338fbd8a1943ec10bf68b74ce/tisumapunenixuzuridoxol.pdfIn PDF document text
- https://dmvassociates.com/wp-content/plugins/super-forms/uploads/php/files/23b01cf85ebf088c19273181fbe7d4cf/36193568417.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=effort+meaning+in+tamilPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000bcdc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBCDC	10372 bytes
SHA-256: `9515dd4cd23cb484dfdec130b553f0d7368b6109ff71e839cc80ee4c4dc3802d`
`font_01_sfnt_off0000d441.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD441	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off0000ec53.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEC53	17856 bytes
SHA-256: `9b09418d384efd602d8058610d1ad307ad918d151f11fd60ad447a4b7efbc253`

Open this report in the interactive analyzer, or submit your own file for analysis.