PDF malware analysis — malicious · 6efc2bbd73f8dbc0

MALICIOUS

PDF

111.1 KB Created: 2021-07-07 18:32:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14

MD5: 984864d4d733dd096837973fd07ecd1b SHA-1: 1578b3a2a5ee3427b5e9fb986b3a4de74db2caae SHA-256: 6efc2bbd73f8dbc0bb3fe05c46406e777e4824cef20299d2646034678eab363a

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The file contains numerous embedded URLs, many pointing to compromised WordPress sites, suggesting it functions as a link farm to distribute malicious content or conduct phishing attacks. The presence of external URI links and the compromised CMS upload link heuristic indicate a strong intent to redirect users to potentially harmful destinations.

Machine Learning

Nyx PDF Classifier malicious score 0.9886

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://chcial.ru/uplcv?utm_term=types+of+herniations PDF link annotation
- https://ncfouting.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bce2d84e1c0---sijimobonota.pdfIn PDF document text
- http://ongnuocdenhat.com/upload/files/jinexanumo.pdfIn PDF document text
- http://ednak.com/wp-content/plugins/formcraft/file-upload/server/content/files/160982afaa8fa4---fofuvasimuleme.pdfIn PDF document text
- http://plenar.hr/wp-content/plugins/formcraft/file-upload/server/content/files/160cf0afd74f96---lazuviluzuzetirovato.pdfIn PDF document text
- http://restorationteleconference.com/clients/73716/File/42747941023.pdfIn PDF document text
- https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/40b7431e09e2a02901703832dfcc12cc/54137910880.pdfIn PDF document text
- http://www.radiopopiatej.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090a9008b355---13323159794.pdfIn PDF document text
- http://cokhitienvuong.com/uploads/files/35635918041.pdfIn PDF document text
- http://timelessmebel.ru/wp-content/plugins/super-forms/uploads/php/files/a43928106053cc9690589e234dac2cde/86911129360.pdfIn PDF document text
- http://myarrahnu.com/mo_images/files/45629932665.pdfIn PDF document text
- http://wardwrightself.com/clients/863644/File/lijovinuniwabimupezozog.pdfIn PDF document text
- http://uleshuzatshop.hu/files/file/xapubugegudiba.pdfIn PDF document text
- https://unique-u.biz/images/uploads/file/xovabedakonimuzipexuji.pdfIn PDF document text
- https://aawyx.com/sites/default/imageuser/file/merefikede.pdfIn PDF document text
- https://www.sussexweddingservices.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1607e0c6f4d88b---rafojopadagar.pdfIn PDF document text
- https://www.reliancecareuk.com/wp-content/plugins/super-forms/uploads/php/files/02f14400bca7229514dff35292edb810/gudutaleseraj.pdfIn PDF document text
- https://nicemexico.net/wp-content/plugins/formcraft/file-upload/server/content/files/160a787d32724a---43577431082.pdfIn PDF document text
- http://traditionsradio.com/wp-content/plugins/super-forms/uploads/php/files/agshpjjl4qqeo9t50ocilphhm0/10223425664.pdfIn PDF document text
- http://schodylux.pl/userfiles/file/66341231308.pdfIn PDF document text
- http://anandamsanyal.com/userfiles/file/sixibexom.pdfIn PDF document text
- https://gretajensen.com/ckfinder/userfiles/files/retilunajolirokevozavoz.pdfIn PDF document text
- https://englewoodgrassfarm.com/wp-content/plugins/super-forms/uploads/php/files/8baf58a528402dc793aab866c1e001a4/12038300015.pdfIn PDF document text
- http://www.alwaysflorida.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cd4a18b1fed---foxuxobezovilibusojamem.pdfIn PDF document text
- https://cooperspick.com/files/89792865569.pdfIn PDF document text
- https://sailstudy.in/ckfinder/userfiles/files/75144757371.pdfIn PDF document text
- http://weddingdiy.cc/uploadfiles/files/20210626_120610_1399.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00014dd2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14DD2	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off000165e9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x165E9	10484 bytes
SHA-256: `f543e5bbe1e78533b936e8b9ba796ae5e709a34e1d37e2a3e28dcabf491cdbb3`
`font_02_sfnt_off00017dbd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x17DBD	18948 bytes
SHA-256: `641d9200739eeaf46e536831d6f1a92d9fba9335c787b7e00948bd6670f4cd7c`

Open this report in the interactive analyzer, or submit your own file for analysis.