PDF malware analysis — malicious · 613d5ece94c2af9f

MALICIOUS

PDF

82.6 KB Created: 2021-07-08 08:23:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-23

MD5: 62196a9a3e0886c28ec4def09756cb2a SHA-1: ec988b468aecaef8d8206ad2fada245f74942b39 SHA-256: 613d5ece94c2af9f8f27bf221574319735201e8ea936d7f7f4ef377854d2d56b

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded URLs, many of which point to compromised WordPress upload directories, indicating a link farm designed to redirect users to potentially malicious sites. ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent, likely related to phishing or malware delivery via these links.

Machine Learning

Nyx PDF Classifier suspicious score 0.4208

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://archinfo.ru/uploads/file/27407405137.pdf In PDF document text
- http://tbm-mova.by/images_from_html_editor/file/biwalaromabusaxeraviruf.pdfIn PDF document text
- https://marathonroller.com/userfiles/files/30517206102.pdfIn PDF document text
- https://ekselantechnology.solutions/ckfinder/userfiles/files/sumifuxujot.pdfIn PDF document text
- http://mayinluatudong.com/uploads/userfiles/file/lenajus.pdfIn PDF document text
- http://english-island.pl/wp-content/plugins/super-forms/uploads/php/files/ad5c79ol0hssag846508um6c57/motufuzimon.pdfIn PDF document text
- https://pediatricpotentialsnj.com/PP/PPpng/files/38455658521.pdfIn PDF document text
- https://sketchup360.vn/wp-content/plugins/super-forms/uploads/php/files/vr39llej27o33t8b3h2483t03h/vexitokegerutajitelazux.pdfIn PDF document text
- https://pk-kuepfer.ch/ckfinder/userfiles/files/dikubufujizaxemif.pdfIn PDF document text
- http://smithmurdock.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071d65c8e100---80821825208.pdfIn PDF document text
- https://www.phoenixdentalacademy.co.uk/wp-content/plugins/super-forms/uploads/php/files/beb751d92d38d811ba03305f961f19ae/dagazeki.pdfIn PDF document text
- http://guanzhuli.com/userfiles/file/62997708363.pdfIn PDF document text
- https://ural-aiti.ru/admin/ckfinder/userfiles/files/64534706724.pdfIn PDF document text
- http://assessmentinsight.com/ckfinder/userfiles/files/bomavepojerizalosafegu.pdfIn PDF document text
- https://adbetelparaguay.com/wp-content/plugins/super-forms/uploads/php/files/e8d216c998263cb12e19aa50193c6ac8/51237647944.pdfIn PDF document text
- https://jnvhardoi.org/ckfinder/userfiles/files/nitijuti.pdfIn PDF document text
- https://centrobrands.com/wp-content/plugins/super-forms/uploads/php/files/83d86ba202c062a7bb153a1057a5a329/jadetev.pdfIn PDF document text
- https://skyfireconsulting.com/wp-content/plugins/super-forms/uploads/php/files/kbf139d87lmfpcfr9450o9tubp/figozimuzaw.pdfIn PDF document text
- https://www.etbsupplies.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b55ee2d49be---13433202113.pdfIn PDF document text
- https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160729f17c4709---dozobikizulana.pdfIn PDF document text
- https://www.advids.io/wp-content/plugins/formcraft/file-upload/server/content/files/160ca94b6690f0---vomijew.pdfIn PDF document text
- https://agilitynd.com/wp-content/plugins/super-forms/uploads/php/files/0cc1eddc36b7461436e31df596436bf6/11403424641.pdfIn PDF document text
- http://www.kreasoft.mx/wp-content/plugins/formcraft/file-upload/server/content/files/1607848e217842---ruxafomed.pdfIn PDF document text
- http://automsystem.com/UploadFile/file/20210502195949781.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/BvfzZFkJO3s/uplcv?utm_term=early+film+with+soundPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f5fa.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF5FA	10772 bytes
SHA-256: `125f009cb0a2c6d1a2c451fc3c5539a62aca21efd7784aa269b006153cd81e67`
`font_01_sfnt_off00010e97.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10E97	17308 bytes
SHA-256: `c513ab612d75d7854c1ccb031fb6ee677c23565a682cf25c4d3551ff3bd2b731`

Open this report in the interactive analyzer, or submit your own file for analysis.