PDF malware analysis — malicious · 5ba6cc454ed7985c

MALICIOUS

PDF

80.2 KB Created: 2021-07-13 23:50:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14

MD5: a06f12ea73383f3ea7d77df113a188de SHA-1: b414b816b4aaf3b2ef9e501c3c05b6c474975960 SHA-256: 5ba6cc454ed7985c4f8274f7a5f43ec0109e016dd5819fdad61bb1ad921bbd11

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1055.012 Process Injection

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. Heuristics identified it as a link farm hosted on compromised WordPress sites, suggesting a phishing or malware distribution scheme. The presence of multiple URLs pointing to potentially compromised domains supports this assessment.

Machine Learning

Nyx PDF Classifier malicious score 0.9949

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://siphouse96.com/wp-content/plugins/super-forms/uploads/php/files/c7110d1fe1ee47e2c3e0e7855e35df75/luroxifik.pdf In PDF document text
- http://metzpaintings.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c47dba29eb5---57595999814.pdfIn PDF document text
- http://zge-led.com/luodan/images/userfiles/file/jatexog.pdfIn PDF document text
- http://prplus4u.com/ckupload/files/mikanukedetanalozasov.pdfIn PDF document text
- https://akdenizokullari.k12.tr/wp-content/plugins/super-forms/uploads/php/files/b8o8ooujbteg0ik7k59eq07h3l/jumukagifowadev.pdfIn PDF document text
- http://ahkjt.com/upfile/file/2498675667.pdfIn PDF document text
- https://blueridgelightingandcontrols.com/wp-content/plugins/super-forms/uploads/php/files/322eae93c0706bded82c61110278ed14/3701648795.pdfIn PDF document text
- http://socialbomjesus.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160d63d635b677---benitijakumukapek.pdfIn PDF document text
- http://markfarolaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/pikozotozigopirapuvetutaj.pdfIn PDF document text
- http://circuitvietnamcambodge.com/hinhanh/file/zetiwamep.pdfIn PDF document text
- https://chocoinmobiliario.com/wp-content/plugins/super-forms/uploads/php/files/e80f156bc1a28e8fd0d296c16a292d67/89321806088.pdfIn PDF document text
- https://414movement.com/wp-content/plugins/super-forms/uploads/php/files/25400a3fe83c8d3c3199da42931a17fd/dinarapajiredo.pdfIn PDF document text
- https://expungemyrecordnj.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b242149335---sivomakikifikovomo.pdfIn PDF document text
- https://halobysciton.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac16da75984---10330602275.pdfIn PDF document text
- https://mkting.com.co/wp-content/plugins/super-forms/uploads/php/files/ad816dc16f00871b285274f5dfdf1b44/wadubobonunizetujomog.pdfIn PDF document text
- http://clinicacomciencia.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16072828568680---tekugorixatinezidevasaxok.pdfIn PDF document text
- https://mma-montessori.com/admin/ckfinder/userfiles/files/wakosazokitegulepugufufu.pdfIn PDF document text
- http://technoculture.cz/admin/upload/file/wodisevujifa.pdfIn PDF document text
- https://rsun.pro/admin/ckfinder/userfiles/files/mikeliw.pdfIn PDF document text
- http://dodici12.ru/wp-content/plugins/super-forms/uploads/php/files/vl9k3v2udtcp48l9lf77btj846/90029000898.pdfIn PDF document text
- http://concilianavarra.com/userfiles/files/50699008195.pdfIn PDF document text
- https://www.straightmyteeth.eu/wp-content/plugins/super-forms/uploads/php/files/5ed624c63e44d8742ce9c42f7ba5fb17/10490973090.pdfIn PDF document text
- http://somsit.com/ckfinder/userfiles/files/72065036164.pdfIn PDF document text
- https://kmkmekanik.com/upload/ckfinder/files/jotopividuvesixepumivexu.pdfIn PDF document text
- https://lesura.net/userfiles/file/tegefalilugivib.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=what+is+the+valley+of+ashes+great+gatsbyPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d92f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD92F	16036 bytes
SHA-256: `11bab3bce889619652335d708de278f05ef054506a9538c75d11983807885963`
`font_01_sfnt_off0001026b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1026B	10700 bytes
SHA-256: `293fea58599470b8f7d447a3a706075089f2151465063593357bc073a720e0e1`
`font_02_sfnt_off00011b2c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11B2C	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.