PDF malware analysis — malicious · 768aa3875e426d6e

MALICIOUS

PDF

78.5 KB Created: 2021-06-28 03:18:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23

MD5: 0636f974cbb9168b00454adb13e3e6d7 SHA-1: 168eff23c36e736601fd0caa5cc3369dbd69ed43 SHA-256: 768aa3875e426d6edfed2fe296eca27399975d8abdb988498110ba6be284b27a

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous links to external websites, many of which are hosted on compromised WordPress sites or disposable domains, suggesting a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a malicious redirection chain, likely serving as a lure for users to click through to malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9940

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crysiq.ru/uplcv?utm_term=how+to+pronounce+usually PDF link annotation
- https://iominneapolis.com/wp-content/plugins/super-forms/uploads/php/files/ff2108da781e393bad4d162575db59ff/72445870805.pdfIn PDF document text
- http://terezmisszio.eu/files/file/8879444443.pdfIn PDF document text
- https://www.accidentinjuryalbuquerque.com/wp-content/plugins/super-forms/uploads/php/files/gvqieumasfa9atjtf6llahhbs1/lituvodorowubemitup.pdfIn PDF document text
- http://totalfinance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160a0eb1c88ddb---majotikezoxot.pdfIn PDF document text
- https://www.sharpeningfactory.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a12c5dccc0---64670762195.pdfIn PDF document text
- http://slhs1958.com/clients/18590/File/kulajerag.pdfIn PDF document text
- http://greenlivinggarden.com/htdocs/UserFiles/file/36660533701.pdfIn PDF document text
- https://hmjrgoldhockey.org/wp-content/plugins/super-forms/uploads/php/files/5372fb649a292fbfbc8da0a6b64d6e3a/rebasufifojup.pdfIn PDF document text
- https://studiogreenwich.ru/wp-content/plugins/super-forms/uploads/php/files/967477b611392ba4bb54f816f137e693/9890948196.pdfIn PDF document text
- https://orrizon.ru/images/file/titojirin.pdfIn PDF document text
- https://www.davidcosz.de/wp-content/plugins/super-forms/uploads/php/files/141tmbavdsa3hm94gujhc00u63/16892606496.pdfIn PDF document text
- http://www.idenet.net/wp-content/plugins/formcraft/file-upload/server/content/files/160ba34461db82---8578724281.pdfIn PDF document text
- https://member-amz-seller-system.de/wp-content/plugins/super-forms/uploads/php/files/1e48819bcc798efb51da1ceb87f9b12f/wasusutumagupibasuvarosiz.pdfIn PDF document text
- http://airconbank.com/upload/fckeditor/file/sakutexusebisesimekabo.pdfIn PDF document text
- https://personalloan2u.com/wp-content/plugins/super-forms/uploads/php/files/5e3554997af6e1a80ec2555f7c43d874/2448639872.pdfIn PDF document text
- http://pkynfe.net/userfiles/file/towurux.pdfIn PDF document text
- http://www.linkkorea.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/160cc763663831---86585549246.pdfIn PDF document text
- https://designclarf.it/file/17398640998.pdfIn PDF document text
- https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/160c335455cd48---vowatelevoramubofurevow.pdfIn PDF document text
- https://www.brunosistemi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c62a75cc271---baseregofanesalineneke.pdfIn PDF document text
- https://bringem.de/wp-content/plugins/super-forms/uploads/php/files/8956d7c20431f562d1390b35b3fe2bf5/ravoni.pdfIn PDF document text
- http://cafemsoffice.com/userfiles/files/98013128631.pdfIn PDF document text
- http://www.rlktechniek.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16077c78ec0ace---wipizazejezo.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000bc44.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBC44	19852 bytes
SHA-256: `1c9da2318ac75717192c15bd214f0754dcacea3376cd6382b58bf4da441f19ac`
`font_01_sfnt_off0000ed86.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xED86	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off0001059d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1059D	10568 bytes
SHA-256: `0d7d6f6c42c2f8b45cfc88f6ea35bc5d646eabfe79626a0df10b0e8fb85ec782`
`font_03_sfnt_off00011def.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11DEF	3180 bytes
SHA-256: `3d21a0392e3014abfedf30c34d38bbc52da32e91305731cb56cd5f27842cddbf`

Open this report in the interactive analyzer, or submit your own file for analysis.