PDF malware analysis — malicious · 7380777f3d640034

MALICIOUS

PDF

79.8 KB Created: 2021-09-05 19:15:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05

MD5: 0b9912345f1c981b92c104539b5da069 SHA-1: abc937011f89482805e7d2cc6a4205a4f5ad7b77 SHA-256: 7380777f3d6400340abf732744ab5da1f5a16096c6d96059b0a3a2cd3c30cbb5

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by a machine learning classifier and ClamAV as malicious. It contains a link farm pointing to multiple compromised WordPress sites and other disposable hosting, suggesting an attempt to redirect users to malicious content. The presence of external URIs and a link farm indicates a phishing or redirection attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.9949

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.ojchamber.com/ckfinder/userfiles/files/23466598640.pdf In PDF document text
- https://mediabandit.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607df72f0dfa3---44443328873.pdfIn PDF document text
- http://quickvideo.nl/userfiles/file/63031785633.pdfIn PDF document text
- http://sea-cruise.ru/ckfinder/userfiles/files/58390829546.pdfIn PDF document text
- http://johncarroll1967.com/clients/1/18/1896e795ecc2602204d707ec4e69586f/File/zufafagowudosazofelixagab.pdfIn PDF document text
- https://theloneranger.tv/clients/loneranger/ckfinder/userfiles/files/wijojer.pdfIn PDF document text
- https://stpatswatertown.org/ckfinder/userfiles/files/xiwajotolibipufizifonogim.pdfIn PDF document text
- https://psychologgia.pl/Upload/file/ziripudobaxizejukav.pdfIn PDF document text
- http://deurenhanger.nl/userfiles/file/vudovagujemupokupasake.pdfIn PDF document text
- http://aahsclassof1978.com/clients/b/b6/b6117739535924054831d33ecd54b00a/File/16627691014.pdfIn PDF document text
- https://forkidsvietnam.vn/wp-content/plugins/super-forms/uploads/php/files/7rf09ni8mb5jb0c5ruitf6imll/2912920489.pdfIn PDF document text
- http://www.miamiairportlimo.net/wp-content/plugins/formcraft/file-upload/server/content/files/1610bcfd183b2a---faxoledawivezatigog.pdfIn PDF document text
- https://detector-billetes.com/Imagenes/file/70100568282.pdfIn PDF document text
- https://kozmetikadunakeszi.hu/userfiles/file/90614040348.pdfIn PDF document text
- http://accessiblevehicleservices.com/userfiles/file/zikago.pdfIn PDF document text
- http://www.saito-ken.jp/userdata/file/57459121660.pdfIn PDF document text
- https://edukiya.com/wp-content/plugins/super-forms/uploads/php/files/f4ccc9a673886c26a7d7cad06da8e12d/lujanozelol.pdfIn PDF document text
- http://yer-krasnodar.ru/ckfinder/userfiles/files/vinuxulizujifo.pdfIn PDF document text
- http://ranaghatpchsschool.org/userfiles/file/levutatonujaxi.pdfIn PDF document text
- https://maxim-catering.de/wp-content/plugins/super-forms/uploads/php/files/3ms46mmjt45veshl7rra5dk55o/89322412037.pdfIn PDF document text
- http://suachuaspa.com/upload/images-content/files/banizezijinixofesubos.pdfIn PDF document text
- https://pabausa.org/wp-content/plugins/formcraft/file-upload/server/content/files/160735cc71c178---34625626824.pdfIn PDF document text
- http://naasschoolofmotoring.com/fckeditor/userfiles/file/83564400682.pdfIn PDF document text
- http://conblocmanado.com/pics/file/vezaxabidosif.pdfIn PDF document text
- http://artside.org/data/temp/file/lodej.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/BkSY9tpko7c/uplcv?utm_term=quadrilaterals+worksheets+pdfPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d248.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD248	10828 bytes
SHA-256: `d2d83042d87a1225f1d7ba98dc44ac17b88c8a1f4a59e12ccfead05414cac825`
`font_01_sfnt_off0000eb83.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB83	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00010395.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10395	17896 bytes
SHA-256: `2dd00fe3e137f0c77eedb6d1e1a98cd7e73f42e5d855dfed5f16d255bdb3186f`

Open this report in the interactive analyzer, or submit your own file for analysis.