PDF malware analysis — malicious · 7e8c4413764ad8aa

MALICIOUS

PDF

74.3 KB Created: 2021-09-02 12:32:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14

MD5: c7c1f196cf5ceb4c075ac78d54e3a769 SHA-1: 381b0321bd66497d6c96cc511d961a003a48624d SHA-256: 7e8c4413764ad8aa5495d881276804e296baf3f9b0c1dc31c40e6c6061c6c27d

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. Heuristics identified the document as a link farm, with multiple URLs pointing to compromised WordPress upload directories and disposable hosting, suggesting an attempt to redirect users to malicious sites. The presence of these links indicates a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9827

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.greenbriarpropmgmt.com/wp-content/plugins/super-forms/uploads/php/files/09243c8f328ad460c97aca345842d2ba/zopavadepupuroribik.pdf In PDF document text
- https://sipsib.ru/wp-content/plugins/super-forms/uploads/php/files/1c4909fe806769d4b85cc5e9173a2123/vumojazodufumig.pdfIn PDF document text
- https://transport.frontiermyanmar.com/sites/all/libraries/ckfinder/userfiles/files/xiduza.pdfIn PDF document text
- https://calendarsunrooms.com/userfiles/files/92797610663.pdfIn PDF document text
- http://abwcoliseum.com/uploads/files/94236904489.pdfIn PDF document text
- https://www.alongsideasia.com/wp-content/plugins/super-forms/uploads/php/files/6d05f966a64805498e01632a505b3596/62280608501.pdfIn PDF document text
- http://dom-nenilovo.ru/wp-content/plugins/super-forms/uploads/php/files/703961b3cb51b586ccbe51781294eaeb/roterokudufubulores.pdfIn PDF document text
- https://lea-inc.com/wp-content/plugins/super-forms/uploads/php/files/385b7a9cc1a49b29bd996135cd1c2939/38744657342.pdfIn PDF document text
- http://machinegroup.ru/img/outer/files/42055461881.pdfIn PDF document text
- http://www.gaviprintpack.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d94d833c9c6---giropabatizosufowik.pdfIn PDF document text
- http://cityclick.it/userfiles/files/91023344985.pdfIn PDF document text
- http://princeverma.in/uploads/files/daditomifizatupubasoxiwa.pdfIn PDF document text
- http://ideatity.com/ckfinder/userfiles/files/22334934130.pdfIn PDF document text
- http://www.alwaysflorida.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c2a8d64c017---16313066358.pdfIn PDF document text
- https://www.sodigital.it/wp-content/plugins/formcraft/file-upload/server/content/files/16086d1d515a68---sodibigipadamugonadi.pdfIn PDF document text
- https://assurancemauricie.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f4b9ba7636e---liluxedat.pdfIn PDF document text
- http://denki-shonan.com/uploadsfile/3823352202.pdfIn PDF document text
- http://www.jobsincrete.gr/images/_user_na/file/99574426647.pdfIn PDF document text
- https://cor.org.ar/wp-content/plugins/super-forms/uploads/php/files/bche2jto3hpt2b1ic1252tbp4m/pusopumot.pdfIn PDF document text
- https://jdlpartnerss.com/userfiles/file/20507972016.pdfIn PDF document text
- https://www.mobytec.com.br/mobytec/wp-content/plugins/formcraft/file-upload/server/content/files/1607eb92d1b390---desefumexamowarulibubi.pdfIn PDF document text
- http://studiotipaldo.com/userfiles/files/poroxorexu.pdfIn PDF document text
- https://ostrichpharmaceuticals.com/userfiles/file/zusowikibe.pdfIn PDF document text
- http://leap-egypt.com/wp-content/plugins/formcraft/file-upload/server/content/files/160962349b5069---pajebode.pdfIn PDF document text
- https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/qm2fkmkbcc2ahngfvsqm07boek/92808717521.pdfIn PDF document text
- http://www.absolutecateringla.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c36e9374d3f---96910588491.pdfIn PDF document text
- https://spvi.cn/filespath/files/20210820192326.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=south+asia+geography+pdfPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c063.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC063	16368 bytes
SHA-256: `b0089437743b70e8472500e53e0d71ab064f064b41c85707fe13f44adddbd003`
`font_01_sfnt_off0000ea6e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEA6E	10916 bytes
SHA-256: `facdd2868653139e0478e0594fe1e58b326b88db3da3e89b06ae0e5a1943b72f`
`font_02_sfnt_off000103b7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x103B7	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.