PDF malware analysis — malicious · 5927718bc0c94da2

MALICIOUS

PDF

88.5 KB Created: 2021-09-02 01:45:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24

MD5: e910387399a70dc06ea9b2caf1518b22 SHA-1: f13b99a34aecb1d2b86e34d8b36389da0cc8101b SHA-256: 5927718bc0c94da299c3ed8bd4cb1fab28f8863d858f420e10f47e8eee183175

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a link farm. It contains numerous embedded URLs pointing to compromised WordPress sites and other domains, suggesting an attempt to redirect users to phishing or malware-hosting pages. The document's structure and the presence of multiple external links indicate a likely spearphishing attachment used to distribute malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9877

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://garglob.ru/uplcv?utm_term=past+participle+example PDF link annotation
- https://mediabandit.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b414c735fd---dezemuvozodak.pdfIn PDF document text
- https://nycsmindia.org/ckfinder/userfiles/files/tudavovotubezagufojemuj.pdfIn PDF document text
- http://jcbcharpentebois.com/ressource/site-image/files/3378777562.pdfIn PDF document text
- http://www.peopleoftheheath.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608998f3b7b68---10162109791.pdfIn PDF document text
- http://akkoryazilim.com/userfiles/file/ronafomuxere.pdfIn PDF document text
- https://jennysbooks.com/wp-content/plugins/super-forms/uploads/php/files/e387ceb8e34386ad6065fdfea2f9fb2c/kuwifikekuraxuvodegugiz.pdfIn PDF document text
- https://sarujiovalente.com/wp-content/plugins/super-forms/uploads/php/files/i5asd3aucmkhftuicbnheseghf/tibepetolofusogevoluvebi.pdfIn PDF document text
- https://holocaustresearch.pl/nowy/photo/file/2461277526.pdfIn PDF document text
- https://bamfieldrental.com/userfiles/file/nerusewopolofilojije.pdfIn PDF document text
- http://oguzlarotomatiksanziman.com/depo/sayfaresim/file/tugujilazetodemofovex.pdfIn PDF document text
- https://autoschiller.de/wp-content/plugins/formcraft/file-upload/server/content/files/16070fd817ba94---47926716685.pdfIn PDF document text
- http://tpdw.pl/userfiles/file/74255020011.pdfIn PDF document text
- http://queuemanagementsystems.com/wp-content/plugins/formcraft/file-upload/server/content/files/16116097d91418---doledererilituxebowerine.pdfIn PDF document text
- https://toppelletmachine.com/d/files/94715604200.pdfIn PDF document text
- http://toeicspeaking.net/_UploadFile/Images/file/51471884457.pdfIn PDF document text
- http://andreevmag.com/wp-content/plugins/super-forms/uploads/php/files/64f9b84645cbc565b5217530bbeea4cf/90136089458.pdfIn PDF document text
- http://ottotech.center/userfiles/file/58446793829.pdfIn PDF document text
- https://www.champagne-auge-dascier.com/ckfinder/userfiles/files/gasatupuzan.pdfIn PDF document text
- http://wjcopy.com/upload/files/61807990825.pdfIn PDF document text
- http://mfplus.ba/wp-content/plugins/formcraft/file-upload/server/content/files/16073c725aece0---dalogewavudibuvanole.pdfIn PDF document text
- http://aotwresort.org/ckfinder/userfiles/files/64173135660.pdfIn PDF document text
- http://pulsrmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608cca24627c1---20735868507.pdfIn PDF document text
- http://bvsaigonbinhduong.com/uploads/files/1037912025.pdfIn PDF document text
- http://energo-market.ru/sadm_files/80364805267.pdfIn PDF document text
- https://sipare.com.ar/wp-content/plugins/super-forms/uploads/php/files/c99fbrnbjlk8e2b8lmot2b6ma4/48354383092.pdfIn PDF document text
- http://papianiarch.it/userfiles/files/18214047200.pdfIn PDF document text
- http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f0532b156b---10526631223.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f2b9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF2B9	18820 bytes
SHA-256: `54f86f4b9565df7631a59afa500e045c3a525532014151e06588b01070d31457`
`font_01_sfnt_off0001231f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1231F	10416 bytes
SHA-256: `d5bba30ca3cb6446cc280f901a7f37f97f9ab09b06949c95cc5b1c687e3094b3`
`font_02_sfnt_off00013ac5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13AC5	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.