PDF malware analysis — malicious · 85e83f496f6a261a

MALICIOUS

PDF

89.3 KB Created: 2021-08-07 03:48:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26

MD5: c95439cb4c42a00e249ccdac5a598f3f SHA-1: c751ea3d5f20b8210c7c74097f223fa5d7f87613 SHA-256: 85e83f496f6a261af9019f1375dd3d706f6dc4b845fe4dcc9d25ec02fc914fcc

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, many pointing to compromised WordPress sites or disposable hosting, suggesting a phishing or redirection scheme. The PDF structure itself is identified as a link farm, designed to lead users to external, potentially harmful content.

Machine Learning

Nyx PDF Classifier malicious score 0.9905

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://chcial.ru/uplcv?utm_term=texto+expositivo-argumentativo+exemplo+pdf PDF link annotation
- https://www.mobytec.com.br/mobytec/wp-content/plugins/formcraft/file-upload/server/content/files/160964f4fac23d---71466172488.pdfIn PDF document text
- http://gpe-el.pro/ckfinder/userfiles/files/mopufowipanefotul.pdfIn PDF document text
- http://a-range.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16097aacc52e05---62739488308.pdfIn PDF document text
- https://voyagerf.ru/wp-content/plugins/super-forms/uploads/php/files/8e88f46c80aed2f4ada16bd2a5b324a8/44038566238.pdfIn PDF document text
- http://catherine-massage.com/ckfinder/userfiles/files/likuzulanaxizuvijabu.pdfIn PDF document text
- https://sipsib.ru/wp-content/plugins/super-forms/uploads/php/files/e6c19f5a0ed79ba28a29045d1a78731f/vezimibabi.pdfIn PDF document text
- https://alfa-clining.ru/wp-content/plugins/super-forms/uploads/php/files/370c0fb78d33148c0e4a5541b6cd06b3/61894807755.pdfIn PDF document text
- https://connect.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/8fb74cfed7a7d5383c15806cb8fdf073/nodesubin.pdfIn PDF document text
- https://amadesafar.ir/basefile/amadesafarir/files/binawalatiruraz.pdfIn PDF document text
- https://szemvidito.hu/sfwkr/feltoltesek/Images/Image/gefojo.pdfIn PDF document text
- https://muzeumkonstancina.pl/attachments/file/rajagosegepomuk.pdfIn PDF document text
- https://cald-lighting.com/wp-content/plugins/super-forms/uploads/php/files/ccd48519339bc086bb188f214e47157e/39258395035.pdfIn PDF document text
- http://plafondchauffant.fr//img/user/file/89354341005.pdfIn PDF document text
- http://studioambienteterritorio.it/userfiles/files/vafoputireniruwepepesa.pdfIn PDF document text
- http://ecole.ru/text/images/file/49873033708.pdfIn PDF document text
- https://advancedcheckcashadvance.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608776f5a8bff---84639810565.pdfIn PDF document text
- http://jikaramen.com/uploads/files/gutoluzopudiwive.pdfIn PDF document text
- https://www.picmephotoboothhire.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1609885a831cdd---rasatuvuj.pdfIn PDF document text
- https://xn--i1aam8cb.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/89ef16a874b61e14a30a398f92ee5d16/681488063.pdfIn PDF document text
- https://www.unicodesystems.com/wp-content/plugins/super-forms/uploads/php/files/48dvh7qofkf3m9s8rl8n5nvvd5/zamuvonesesodevidunixom.pdfIn PDF document text
- https://siphouse96.com/wp-content/plugins/super-forms/uploads/php/files/2883f4052602f2fe7021bb340922a305/77451910074.pdfIn PDF document text
- http://stkvn.ru/wp-content/plugins/super-forms/uploads/php/files/6ec6a44b2834b42a14e498ebaff6e86d/tinotugigev.pdfIn PDF document text
- https://ebooksweb.net/files/file/13743680359.pdfIn PDF document text
- http://fitnessklub-impuls.pl/uploads/assets/file/kukute.pdfIn PDF document text
- http://rayanchem.com/d/files/webetonekideguruluxetir.pdfIn PDF document text
- http://lifecare4all.com/upload/files/dumakoradu.pdfIn PDF document text
- http://e-kva.ru/admin/ckfinder/userfiles/files/3795895670.pdfIn PDF document text
- http://degrossier.nl/uploads/file/70312729081.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f663.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF663	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off00010e75.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10E75	19052 bytes
SHA-256: `b225b80dbf9dd89926bbace1f478a4eb7c0d4d45b02f9e7b1d2d3c74124bab7a`
`font_02_sfnt_off00013d43.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13D43	11104 bytes
SHA-256: `fddc9199cd02c6b7a8d7555113c597e29b3dcaedb2bdd3668f65639e80475cb4`

Open this report in the interactive analyzer, or submit your own file for analysis.