PDF malware analysis — malicious · 72971345e363332a

MALICIOUS

PDF

106.4 KB Created: 2021-08-16 19:50:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16

MD5: 17100cec528943a63102e9c18b8a0334 SHA-1: 8da871d7e54dabb254e2f9c3c64ffb46a8f3caac SHA-256: 72971345e363332a0209b3330404de417aaffbe4931e3f96e4625aff527da0c0

224 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous links to compromised websites and disposable hosting, indicating a link farm designed to redirect users to malicious content. Heuristics suggest a payment redirection lure and a callback phishing lure, consistent with financial fraud or phishing campaigns. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9618

Heuristics 9

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE

Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://casavacanzesanvito.eu/userfiles/files/rolatevuxibasaned.pdf In PDF document text
- http://beadsandsupplies.com/images/file/vosowepalerubit.pdfIn PDF document text
- https://barrierball.cl/ckfinder/userfiles/files/27051079938.pdfIn PDF document text
- http://www.medicalalliedtraining.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609faa5d51ef8---roxuromirovaxilef.pdfIn PDF document text
- http://megat.pl/uploaded/fck_files/file/gadurosanasuvep.pdfIn PDF document text
- https://suprizpin.com/calisma2/files/uploads/22773258536.pdfIn PDF document text
- http://liccuza.ro/stiri_files/file/37247801308.pdfIn PDF document text
- http://ventmetal.ru/userfiles/files/29758259046.pdfIn PDF document text
- http://turnyras.lt/Files/file/vafijop.pdfIn PDF document text
- https://sipare.com.ar/wp-content/plugins/super-forms/uploads/php/files/jg5uoac5begroc7npsjjdl4jbv/dugekidada.pdfIn PDF document text
- https://aduanaldelvalle.com/userfiles/file/vunorimusotanide.pdfIn PDF document text
- https://rfcorporation.net/wp-content/plugins/super-forms/uploads/php/files/4289223e9c9c1f7e0b57c49a080dc866/fobojudewedes.pdfIn PDF document text
- https://greshamgilessalon.com/wp-content/plugins/super-forms/uploads/php/files/49369bd7df891da025a96ec394af27c8/votef.pdfIn PDF document text
- http://test.uebersetzungen-nesselberger.de/wp-content/plugins/formcraft/file-upload/server/content/files/160ffb9b3f35d8---narexuwe.pdfIn PDF document text
- https://c4ir.ae/wp-content/plugins/super-forms/uploads/php/files/cu0j0e9hk212js01enicg080h6/58836044739.pdfIn PDF document text
- http://x04ydivan.ru/userfiles/file/79324196600.pdfIn PDF document text
- https://rinducm1.com/contents//files/59821361376.pdfIn PDF document text
- https://mygoaltv.org/ipp/images/uploads/files/pabamuji.pdfIn PDF document text
- https://www.waterlooarmsnewforest.co.uk/wp-content/plugins/super-forms/uploads/php/files/77eacc5ea9170f9f6233c178e4db3803/39338467448.pdfIn PDF document text
- https://primeodontorj.com/wp-content/plugins/super-forms/uploads/php/files/f1f08371c89fb0cc7c128e81ba4b2d30/88584543673.pdfIn PDF document text
- http://www.logistiekverbeteren.nl/ckfinder/userfiles/files/8269499555.pdfIn PDF document text
- http://suncitygroup.ir/basefile/suncitygroupir/files/gavirotoxa.pdfIn PDF document text
- https://forkidsvietnam.vn/wp-content/plugins/super-forms/uploads/php/files/puhu8lo6pucannvcu67u7hqqmh/26403277846.pdfIn PDF document text
- http://haciogullari.com/depo/sayfaresim/file/rupizifuwixoteralen.pdfIn PDF document text
- http://palazzodiaz.com/userfiles/files/8297606900.pdfIn PDF document text
- https://tigercabinetry.com/wp-content/plugins/super-forms/uploads/php/files/ff27a348988ad852ba3931bc8adb4948/jarukaranage.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=how+to+make+a+fake+pnc+bank+statementPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00012298.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12298	16080 bytes
SHA-256: `c9fa871d706934500ba7362bcc2679cd089fe7f1d29a584b92b55675ed6be739`
`font_01_sfnt_off000137bc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x137BC	19188 bytes
SHA-256: `b743c2d42ca791df36f0d822e91999ad702a68b55bf2c676f1b9c7aa792d593a`
`font_02_sfnt_off00016ad0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x16AD0	10712 bytes
SHA-256: `829a4e11bf312c171713da2a225e139d43c1712463bfc0ece952afffdcf24939`
`font_03_sfnt_off0001833c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1833C	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.