PDF malware analysis — malicious · 5b315fcc5d3f1894

MALICIOUS

PDF

87.2 KB Created: 2021-07-19 22:15:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25

MD5: c771cd88a85fbe323137409195f4bac8 SHA-1: 53633951ed21e98f13967a1de2c46fa3bc85057d SHA-256: 5b315fcc5d3f1894345dfe65be8b945ad71b92c83a3aee1277728fc45e271852

176 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a PDF file that exhibits characteristics of malicious activity, including malformed streams and a link farm pointing to compromised websites. The ML classifier and ClamAV detection strongly indicate malicious intent. The PDF likely exploits a vulnerability to redirect users to a series of URLs, which are part of a link farm designed to obscure the final destination, potentially leading to phishing or malware downloads.

Machine Learning

Nyx PDF Classifier malicious score 0.9607

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTH

A PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://andlupa.com/userfiles/file/vomobumekuxinife.pdf In PDF document text
- https://flycam.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16075500382657---radin.pdfIn PDF document text
- https://ladangmimpi.com/contents//files/9749773695.pdfIn PDF document text
- http://reclaimsplus.com/wp-content/plugins/super-forms/uploads/php/files/7f7f2a9db3d6148b82bcaf9ca9e33134/12632076832.pdfIn PDF document text
- http://www.socalgreatwhite.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086c0cf20648---94268509686.pdfIn PDF document text
- https://trsbarriersdirect.com/wp-content/plugins/super-forms/uploads/php/files/o27ptpjfvj63r5khan3jjfre2d/26926388754.pdfIn PDF document text
- http://lilit-realty.com/wp-content/plugins/super-forms/uploads/php/files/pj4vn82a94nsjkvvd989l9qai6/8163342080.pdfIn PDF document text
- https://faprosid.com/file/8815441094.pdfIn PDF document text
- https://tl-systems.hu/files/files/jizemoxutixa.pdfIn PDF document text
- http://ahs1978hounds.com/clients/0/09/09313dc2b2b2138818c22350edca9cf7/File/31006041414.pdfIn PDF document text
- https://circolodelpistone.ch/userfiles/file/retorima.pdfIn PDF document text
- http://grani-tonkogo-mira.ru/wp-content/plugins/super-forms/uploads/php/files/5a519a68735409fb74e884d477046564/35348864977.pdfIn PDF document text
- http://andreevmag.com/wp-content/plugins/super-forms/uploads/php/files/18415c861202a181367b4dff2377672f/23311861191.pdfIn PDF document text
- https://christembassybarking.org/wp-content/plugins/super-forms/uploads/php/files/58df0a6c2e796deb72d835901332cfc4/53083263099.pdfIn PDF document text
- https://hotelritariccione.it/wp-content/plugins/formcraft/file-upload/server/content/files/160c23d5691e0b---wopuf.pdfIn PDF document text
- http://ecohost.ru/pics/images/file/87793736755.pdfIn PDF document text
- http://ondrejkocar.cz/img/file/pipoxop.pdfIn PDF document text
- http://www.alexgis.com/siteuploads/editorimg/file/38215568809.pdfIn PDF document text
- https://www.idahomedia.com/wp-content/plugins/super-forms/uploads/php/files/8dc479e7ff975555c2e7f1a4923f10f1/meloxulejesugoxibizivu.pdfIn PDF document text
- https://www.propertyfilevault.com/wp-content/plugins/super-forms/uploads/php/files/9f91ffe4ecb59b5de10bfecb948427eb/biremuzolel.pdfIn PDF document text
- http://www.johnrealestate.in/ckeditor-ckfinder-integration/uploads/files/48921691501.pdfIn PDF document text
- http://www.holderit.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a249e0040a4---73230370263.pdfIn PDF document text
- http://ascensionchina.com/userfiles/file/xixebusa.pdfIn PDF document text
- http://www.circoloaletrium.it/wp-content/plugins/formcraft/file-upload/server/content/files/160ed971b79784---pubuxavodidozo.pdfIn PDF document text
- http://arcomproltd.com/userfiles/file/76284050500.pdfIn PDF document text
- http://nextgenship.net/upload/file/20210519162141569625.pdfIn PDF document text
- http://www.mywil.ch/wp-content/plugins/formcraft/file-upload/server/content/files/160b0e3ed1f9d4---jewanewexevadazesokanon.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/Om9ozkHLxGw/uplcv?utm_term=agriculture+chemistry+book+pdfPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ccf3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCCF3	1952 bytes
SHA-256: `56f9c99ad89a15a5c6ec127538dd135100cd1736b80faadc67ee1fd6dee6851e`
`font_01_sfnt_off0000d606.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD606	16348 bytes
SHA-256: `d4a9ea97b10958e9a748599400755110ad8675748aaa9715fd11575ab2d936a9`
`font_02_sfnt_off0000ec66.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEC66	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_03_sfnt_off00010478.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10478	17872 bytes
SHA-256: `165065b8da16a23706850186f4dd9b683d1395c28ef962f3a3fd03a2a4dc5c90`
`font_04_sfnt_off000132a5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x132A5	11228 bytes
SHA-256: `e194012d7f06e963fd1beef16944981cb923401c7f8270c0da9c843e70259c9e`

Open this report in the interactive analyzer, or submit your own file for analysis.