PDF malware analysis — malicious · 7b795e9dbd3d4c2b

MALICIOUS

PDF

82.7 KB Created: 2021-09-02 13:22:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23

MD5: b47b9776402491254e84e451b1222789 SHA-1: 97682105032e33ff282ea2ff3a7502e5e3e638a7 SHA-256: 7b795e9dbd3d4c2bf487fd64e01208c0c857626fe694104c57d190cc60e240d7

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains numerous external links, many pointing to compromised WordPress sites or disposable hosting, suggesting a link farm designed to redirect users to malicious content. The document body is heavily obfuscated and unreadable, but the presence of external URIs and the PDF_SEO_DISPOSABLE_LINK_FARM heuristic indicate a strong intent to direct users to external, potentially harmful, resources.

Machine Learning

Nyx PDF Classifier malicious score 0.9833

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://medvor.ru/uplcv?utm_term=normas+apa+2019+pdf+gratis PDF link annotation
- http://fujavietnam.com/images/Download/41817170871.pdfIn PDF document text
- https://amagi.la/wp-content/plugins/formcraft/file-upload/server/content/files/160dcb629c1a2e---30718781449.pdfIn PDF document text
- http://soupworld.de/upload/file/risegovokozesizek.pdfIn PDF document text
- https://www.carlosfunes.es/wp-content/plugins/formcraft/file-upload/server/content/files/160948bc63b749---mabuxavof.pdfIn PDF document text
- http://graviroz.hu/ckfinder/userfiles/files/80789491815.pdfIn PDF document text
- https://motelandratecuci.ro/userfiles/file/pexozijepupabobuvobite.pdfIn PDF document text
- https://mandalaconfeccao.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16070e7d357d88---46039181429.pdfIn PDF document text
- http://generaltubi.com/container/ckfiles/files/dijuzom.pdfIn PDF document text
- https://profbuhotchet.ru/wp-content/plugins/super-forms/uploads/php/files/ee0ace563675ec28998beac0f14ded5b/40318711091.pdfIn PDF document text
- https://afd.me.uk/wp-content/plugins/super-forms/uploads/php/files/h3gimqgk7q2jopaq9ne7fme2u2/xulufiripoj.pdfIn PDF document text
- http://www.rkcomdesignservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073e2c538d59---41304030496.pdfIn PDF document text
- http://nesthomes.in/userfiles/file/1002486970.pdfIn PDF document text
- http://coffee33.ru/archive/file/migituvoxebufi.pdfIn PDF document text
- https://usssecuritate.ro/userfiles/file/waxogijaxogovek.pdfIn PDF document text
- http://www.yourhealthyourchoice.org/wp-content/plugins/formcraft/file-upload/server/content/files/1609623011d9d1---navetafebudikotu.pdfIn PDF document text
- http://fantalife.nl/userfiles/file/52921558924.pdfIn PDF document text
- https://allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/8ad37896ae19f89deaf1ac1cc82be0c4/4643543464.pdfIn PDF document text
- http://capital96.com/userfiles/file/17804346768.pdfIn PDF document text
- https://detectagsafety.com/ckfinder/userfiles/files/xelizowikokopu.pdfIn PDF document text
- https://www.entornopublicitario.com/wp-content/plugins/super-forms/uploads/php/files/a31f4bf7a0d7772264b15bb93c5739ae/kavoronotesulavuj.pdfIn PDF document text
- https://laptoptranganh.com/data/dulieu/files/zibexamezuti.pdfIn PDF document text
- http://alituncer.com/userfiles/file/nekotojurunowokomu.pdfIn PDF document text
- http://yuha.be/_files/file/tedawojifubuxoxumunu.pdfIn PDF document text
- https://www.sharpeningfactory.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c188ebf38a---40972910998.pdfIn PDF document text
- http://problemconsulting.com/img/download/files/pelamuridujokenobegoze.pdfIn PDF document text
- https://n95america.com/wp-content/plugins/super-forms/uploads/php/files/e15294e6c21ba9ef714a38bcaf045822/6030543166.pdfIn PDF document text
- http://www.scsi.coop/wp-content/plugins/super-forms/uploads/php/files/9f26f272715567a362f70ec0067f4ba6/47929624332.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dac4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDAC4	18712 bytes
SHA-256: `ceeb5659280fe4533882d07a11b66caa0abef2be3fd08748293513031b5f6df9`
`font_01_sfnt_off00010bb3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10BB3	11000 bytes
SHA-256: `a80622ac07e89ace28331ed4f5f742e785171d1444ac410a9fc1e24be02ee6be`
`font_02_sfnt_off0001252c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1252C	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.