PDF malware analysis — malicious · 66e691a827818940

MALICIOUS

PDF

91.0 KB Created: 2021-07-05 09:10:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14

MD5: bb558f67522c6a393202c830f076f959 SHA-1: 575901452be22dc7c3e6d84aaed81891be7291a3 SHA-256: 66e691a827818940081ff8dfdcc236b53ffaddbb7ab389eda86e22d988d22a7b

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It functions as a link farm, with numerous URLs pointing to compromised WordPress sites and disposable hosting, likely to distribute further malware or phishing content. The presence of multiple PDF link farm heuristics suggests a deliberate attempt to obscure the final destination and evade detection.

Machine Learning

Nyx PDF Classifier malicious score 0.9924

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://inwebjor.ru/uplcv?utm_term=pressure+point+fighting PDF link annotation
- http://iideree.org/wp-content/plugins/formcraft/file-upload/server/content/files/16084495fd7763---lumigitibotexagubu.pdfIn PDF document text
- http://bugaboo-buffalo.eu/UserFiles/File/laromidufitodijodokoseku.pdfIn PDF document text
- https://www.penyembuhanholistikreiki.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c2971bf2e22---nasuwo.pdfIn PDF document text
- https://stpetejazz.com/wp-content/plugins/super-forms/uploads/php/files/oi6qe6snullavnpur12etqqsn7/88232306370.pdfIn PDF document text
- http://optikametuje.cz/userfiles/file/45804686884.pdfIn PDF document text
- http://dakmet.pl/upload/vosimevuzodezusugonag.pdfIn PDF document text
- https://landbondcorten.com/attachment/file/de28c32c28bfc3b6aa59f4f2098bab2a.pdfIn PDF document text
- https://chicagoportablexray.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070f9f77d035---wofazovogobo.pdfIn PDF document text
- https://samsungvrvklima.com/upload/ckfinder/files/80245125212.pdfIn PDF document text
- http://huntland.hu/upload/file/78243829182.pdfIn PDF document text
- https://xn--78-6kce7dfhb9dwb.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/ef5052ed3f4b541fe2f41b90a8d366bc/77577766701.pdfIn PDF document text
- http://thegioituigiay.net/uploads/files/gorewowed.pdfIn PDF document text
- https://dipinkrishna.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089b5dc831f6---dozezemimi.pdfIn PDF document text
- http://szao-spb.ru/images/news/file/tadomerukesu.pdfIn PDF document text
- http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/160886082835d6---rabulokefe.pdfIn PDF document text
- https://haysalon.com/public_html/userfiles/file/82916564006.pdfIn PDF document text
- https://upchealth.net/wp-content/plugins/super-forms/uploads/php/files/13142273a4d4df26fe800aded6713e1a/bipexesiz.pdfIn PDF document text
- http://bazatalty.pl/wp-content/plugins/super-forms/uploads/php/files/8fbe00bfdb54240d7f4c5559214a80f0/96467543060.pdfIn PDF document text
- https://engravestone.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ff7660219b---19150074853.pdfIn PDF document text
- http://www.meglobalinc.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160881c75b3a1f---18796648472.pdfIn PDF document text
- https://pfgmm.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160c98d87c9f4a---zutuzesodo.pdfIn PDF document text
- https://postscriptproductions.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607fd1ce22e14---75238975940.pdfIn PDF document text
- http://bertoniamministrazione.it/bertoni/public/file/96797001464.pdfIn PDF document text
- https://rrvchefs.com/wp-content/plugins/super-forms/uploads/php/files/960820d162dab7406a86ab6f266b42da/vifesexareminakimifiwupub.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000efc3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEFC3	10528 bytes
SHA-256: `f9c61b2520c90900eaa4b240e46a3bf6b2a28c2fe4dcb07b5fc9ad11493a366f`
`font_01_sfnt_off000107a9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x107A9	3404 bytes
SHA-256: `867867df43f74bc23c4c22d7b53be0d164d7cc0a1797d1decada5d84186e0fce`
`font_02_sfnt_off00011592.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11592	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_03_sfnt_off00012da4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12DA4	18316 bytes
SHA-256: `42714d5a06ffb6b9ce903cbcff3b860f460155e91fdb0c7f1d4f42e2ae5339e0`

Open this report in the interactive analyzer, or submit your own file for analysis.