PDF malware analysis — malicious · 6bc5c1d15b6ead56

MALICIOUS

PDF

94.4 KB Created: 2021-09-02 13:14:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05

MD5: 989925b0c4cebb8438d758584522542e SHA-1: 3ae3cb904c362eb50fdb780f42935715e45eabe3 SHA-256: 6bc5c1d15b6ead5642dc78cb9d78ff8b49627b86e83b181efec9be8782ef5cf1

212 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a password-protected-archive lure. The file embeds a large number of external links characteristic of an SEO link farm, many hosted on compromised CMS upload directories, presents a deceptive download button and contains embedded JavaScript. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9769

Heuristics 9

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.ciesol.es/ckfinder/userfiles/files/zaxurufisorenikekurinoxi.pdf In PDF document text
- https://eclipsetheaters.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a176aec71c7---64324494828.pdfIn PDF document text
- http://96stone.ru/userfiles/file/65112755835.pdfIn PDF document text
- http://www.macrolepidoptera.hu/userfiles/files/70225898870.pdfIn PDF document text
- http://zawayakw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075387e5a393---44163923026.pdfIn PDF document text
- http://drivescuolaguida.it/userfiles/files/58674111764.pdfIn PDF document text
- http://a-range.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160bfb1c650be7---kosari.pdfIn PDF document text
- https://londonvipchauffeur.co.uk/wp-content/plugins/super-forms/uploads/php/files/55468e24c08a80f7a32fab7e4fbeb616/vopokazetenuwe.pdfIn PDF document text
- https://ghnservizi.com/file/81384169741.pdfIn PDF document text
- https://wscnaturalhealings.com/wp-content/plugins/super-forms/uploads/php/files/4ef04bd4240f39c00d81c3c6c0ab5fb4/xitogegarusawo.pdfIn PDF document text
- https://www.cir.cloud/wp-content/plugins/formcraft/file-upload/server/content/files/16079a76eb8a18---raxebagemoloka.pdfIn PDF document text
- http://technoauto.jp/js/upload/files/buxunuli.pdfIn PDF document text
- http://www.prieteniitehnicii.ro/documente/file/38960743178.pdfIn PDF document text
- https://machinex-machines.com/UserFiles/File/ninukel.pdfIn PDF document text
- https://www.apartamentselsllacs.com/wp-content/plugins/super-forms/uploads/php/files/978s3dkovgpu5r4lhiqhj2hart/xadujijomozud.pdfIn PDF document text
- http://uro-medical.pl/zdjecia/fotki/file/36027720722.pdfIn PDF document text
- https://dulsuc.cl/userfiles/file/69866349456.pdfIn PDF document text
- http://giovanniseneca.eu/userfiles/files/gefelar.pdfIn PDF document text
- https://k-kompany.ru/wp-content/plugins/super-forms/uploads/php/files/3a8add6f8d21b35dc2b8c4aff46d6150/tavubodiv.pdfIn PDF document text
- https://wilsonbarrera.com/inicio/wp-content/plugins/formcraft/file-upload/server/content/files/1610514122c20d---dajuvaju.pdfIn PDF document text
- http://chamdure.com/DATA/files/tunozozawujof.pdfIn PDF document text
- http://esoftland.com/userfiles/file/44622257253.pdfIn PDF document text
- http://makaifruits.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4bd072c19a---xitinuwi.pdfIn PDF document text
- http://buyyoutubelikes.com/ci/userfiles/files/devudori.pdfIn PDF document text
- https://www.alugutader.fr/ckfinder/userfiles/files/45219756641.pdfIn PDF document text
- https://inclinedigital.com/wp-content/plugins/formcraft/file-upload/server/content/files/16097dd7674c3f---68333998081.pdfIn PDF document text
- http://n-production.com/upload/fckeditor/file/xazomalenazajixidaxodibis.pdfIn PDF document text
- http://www.alwaysflorida.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c2a7568daa2---dumoxir.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/fzgW7-mxBc0/uplcv?utm_term=up+board+time+table+2020+12th+pdfPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e961.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE961	10932 bytes
SHA-256: `f4e30dc1129bce240c585fdc217f019c1d06f5a8313e9a74cf25ffebb5b14d97`
`font_01_sfnt_off00010280.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10280	16232 bytes
SHA-256: `e06ebeaa2bb94d9bf14337b0794fec2c9c4a66e30291689b6f6234bfe360c8a5`
`font_02_sfnt_off00011863.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11863	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_03_sfnt_off00013075.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13075	22984 bytes
SHA-256: `9dc4704fd395ba36c9660fa64ddbd952a1deab272cee6e13702f10af961b0fbc`

Open this report in the interactive analyzer, or submit your own file for analysis.