PDF malware analysis — malicious · 65403ff9bf2e292c

MALICIOUS

PDF

77.6 KB Created: 2021-07-25 00:51:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12

MD5: d82941c396d83b047e9aaf26651354d3 SHA-1: 8511b5c2c08684b3bd803d03e53149706c5e34a1 SHA-256: 65403ff9bf2e292c7647dbb40a63fb9d7592bee7f5e9e8a705057073e267802b

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was flagged by ML classifiers and ClamAV as malicious. Heuristics indicate it functions as a link farm, with numerous external URIs pointing to compromised CMS uploads. The document body is unreadable, but the structure and URL analysis strongly suggest a phishing or SEO spamming campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.9690

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.vibrationmonitoring.asia/wp-content/plugins/formcraft/file-upload/server/content/files/160ca1ab174a44---98329909303.pdf In PDF document text
- https://llsindia.in/FCKeditor/file/23851208345.pdfIn PDF document text
- http://adoriantarla.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160e0fb5a175fa---tevalusedoweteri.pdfIn PDF document text
- http://al-bandak.com/userfiles/file/piwedekuxogiza.pdfIn PDF document text
- http://jeugdopdewetenschapsagenda.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160701eb52ea3f---waworekufewexez.pdfIn PDF document text
- https://arzhosting.com/calisma2/files/uploads/pilenurogizobitesevoko.pdfIn PDF document text
- http://champagne-marc-chauvet.com/images/files/87886579351.pdfIn PDF document text
- http://muacuoi.vn/Pictures/files/98710415381.pdfIn PDF document text
- http://www.farparts.cl/wp-content/plugins/formcraft/file-upload/server/content/files/1608b52d73432b---28964306562.pdfIn PDF document text
- https://avis-medical.ma/wp-content/plugins/super-forms/uploads/php/files/6f84d84195e7b64e0ad227a45fee0d98/86125111080.pdfIn PDF document text
- http://www.iamgoingto1996.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c1a4569406---nagulamifojenaw.pdfIn PDF document text
- http://nieruchomosci-swidnica.pl/userfiles/file/gokudu.pdfIn PDF document text
- http://scouttautomotive.com/editor_uploads/system/files/fepewamobon.pdfIn PDF document text
- http://195exim.com/datas/files/21714852263.pdfIn PDF document text
- https://messianic.live/wp-content/plugins/super-forms/uploads/php/files/e903b045b5ffbaf525a0c9191369a9a0/89257762472.pdfIn PDF document text
- https://sellerflows.com/wp-content/plugins/super-forms/uploads/php/files/ed6b0ee360515112215604bc073a5693/wukaxojivixosimoxopono.pdfIn PDF document text
- https://torrentclub.vip/wp-content/plugins/super-forms/uploads/php/files/ufj2cn0peb1lupkfgg46cu02lu/vumitutuzosijatafi.pdfIn PDF document text
- https://studiogreenwich.ru/wp-content/plugins/super-forms/uploads/php/files/2e756448fd48455febaca6869369c180/jolenewojadunakuxive.pdfIn PDF document text
- http://hzbmsj.net/images/upload/File/69224067454.pdfIn PDF document text
- https://floridainvestment.cz/files/file/89815139427.pdfIn PDF document text
- http://gptools.net/userfiles/file/7238002491.pdfIn PDF document text
- https://alfa-clining.ru/wp-content/plugins/super-forms/uploads/php/files/c8e7e9bb6f1f9539a39f176193b20188/wekijuzojofovasefupis.pdfIn PDF document text
- http://www.alexgis.com/siteuploads/editorimg/file/bejixezusad.pdfIn PDF document text
- http://totalfinance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1608376345a600---48916710362.pdfIn PDF document text
- https://noukos.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160989a9acedd0---seduwexenuzov.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/DOqCt-cVA4I/uplcv?utm_term=como+varia+el+radio+atomico+en+la+tabla+periodica+wikipediaPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000103bc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x103BC	18652 bytes
SHA-256: `62f3a29280098aad313f9450dcc7f2a4882c2378fbc9fef47331c47c60dd1a64`

Open this report in the interactive analyzer, or submit your own file for analysis.