PDF malware analysis — malicious · 7a009bf3c2254b17

MALICIOUS

PDF

80.7 KB Created: 2021-07-27 10:44:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12

MD5: 2a5762f7bb28d05c63a1d32fb36483d8 SHA-1: 1cdae0c1039e93bb5588930313a27e0aba597498 SHA-256: 7a009bf3c2254b173404ca1c130183461dec278c23d6581f2e56c25eeb2f0728

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many of which point to compromised WordPress upload directories, suggesting a tactic to host malicious files or redirect users. The presence of a link farm on disposable hosting further supports a malicious intent to distribute or lure victims.

Machine Learning

Nyx PDF Classifier malicious score 0.6426

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.sensible-seeds-premium.com/wp-content/plugins/formcraft/file-upload/server/content/files/160722e37b4918---rulat.pdf In PDF document text
- https://dewalt-naradi.cz/media/upload/editor/file/88605571760.pdfIn PDF document text
- http://www.molinoag.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bcaf5a82c1d---24784790464.pdfIn PDF document text
- http://alvasari.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083f89a96f15---35821981913.pdfIn PDF document text
- http://piri-piri.pl/ckfinder/userfiles/files/53586171154.pdfIn PDF document text
- http://tubietelbar.hu/uploadfile/gewegujam.pdfIn PDF document text
- http://zartmobilia.com/userfiles/file/20210603062603.pdfIn PDF document text
- http://www.inhd.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16072d0988d6b3---17534272561.pdfIn PDF document text
- https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160ac2366e7fec---48451509379.pdfIn PDF document text
- https://www.bouldersudbury.org/wp-content/plugins/formcraft/file-upload/server/content/files/16076403eab951---gupisumejarixigimosidik.pdfIn PDF document text
- http://quickvideo.nl/userfiles/file/80590516286.pdfIn PDF document text
- http://mountmedpharmacy.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607c07cdd3b24---93776336847.pdfIn PDF document text
- http://antwerp-rentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b8e69a9dff7---mevezobixif.pdfIn PDF document text
- https://nada70.org/userfiles/file/vexirosakumomalunerej.pdfIn PDF document text
- http://www.ellisrasbetonwerke.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607e6334165c0---rosudawafupusoladaroxadif.pdfIn PDF document text
- http://www.nisbd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160be03d41bb55---154013054.pdfIn PDF document text
- http://www.hausman.eu/images/wyswig_images/file/86727365609.pdfIn PDF document text
- https://www.ideaklinikbakirkoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a4594bbaf6---wulefatuzebanukixe.pdfIn PDF document text
- https://e-room.co/userfiles/file/rabuwufaxotagapujugovevo.pdfIn PDF document text
- http://minhnguyenvn.com/uploads/userfiles/file/muzokademoretijunaje.pdfIn PDF document text
- http://mt-filtration.com/uploaded/file/175916162460f42876e7b99.pdfIn PDF document text
- http://qca.ch/userfiles/file/dolafijupipema.pdfIn PDF document text
- http://bebsulmare.com/userfiles/files/29400113632.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/BkSY9tpko7c/uplcv?utm_term=principes+d%27%C3%A9lectrotechnique+cours+et+exercices+corrig%C3%A9s+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f27b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF27B	11276 bytes
SHA-256: `92b70af92919a5a61b2fcc6021feeebf54f9ca37f4c3e1f8132a42f416e96eae`
`font_01_sfnt_off00010c15.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10C15	18916 bytes
SHA-256: `3a6b676ead30b0d3e6626c8a8f40b62ff1a7693af256b49c9123841e48590f45`

Open this report in the interactive analyzer, or submit your own file for analysis.