PDF malware analysis — malicious · 8e15136ea318c39a

MALICIOUS

PDF

74.1 KB Created: 2021-09-20 19:14:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11

MD5: 8f31b41b3ec4bbd229bf5a80c4ec5aa8 SHA-1: 6eeb99fb2fd1361fb566518b97e8807a5188a599 SHA-256: 8e15136ea318c39a3ecdec6c252a2acb94c6c34d68102ccca573604a903b60f3

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains numerous embedded URLs, many of which point to compromised websites or disposable domains, suggesting a link farm designed to redirect users to phishing sites or download further malware. While no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a malicious document, likely delivered via spearphishing.

Machine Learning

Nyx PDF Classifier malicious score 0.7920

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://chcial.ru/uplcv?utm_term=how+to+connect+otg+to+mobile PDF link annotation
- http://bright-inter.com/file_media/file_image/file/juruwajovone.pdfIn PDF document text
- https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/pisj99u93bbfeomr5vhedkfbt1/97271898847.pdfIn PDF document text
- https://www.olympusnorge.no/wp-content/plugins/super-forms/uploads/php/files/4ekgdq5lt20pkcceqlmrf5gtd7/kevove.pdfIn PDF document text
- https://hyosung-gulf.com/uploads/file/ximugap.pdfIn PDF document text
- http://cornaredo.gattinonimondodivacanze.it/themes/userfiles/files/52944563256.pdfIn PDF document text
- https://aluminiosarla.com/userfiles_arla/files/72905612936.pdfIn PDF document text
- http://jedwines.com/cmsCart/upload/file/59942463892.pdfIn PDF document text
- https://taxforce.nl/userfiles/files/vibazedabewogunefen.pdfIn PDF document text
- https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/161469740c935a---75689844251.pdfIn PDF document text
- http://lawyergz.net/uploadfile/files/gijenixexufirit.pdfIn PDF document text
- http://findingthegrey.com/userfiles/file/wuzejifalexag.pdfIn PDF document text
- http://www.southforconstruction.com/frontend/web/ckfinder/userfiles/files/tujox.pdfIn PDF document text
- https://jaunimodienos.lt/wp-content/plugins/super-forms/uploads/php/files/uljkh8vcocs8naqmk3svhb9ji0/8226827226.pdfIn PDF document text
- https://razdolle.by/wp-content/plugins/super-forms/uploads/php/files/vn6ulfbuo1s2v8e4044jllrgm6/39706209169.pdfIn PDF document text
- https://mauspro.net/upload/files/75493158590.pdfIn PDF document text
- http://airmon.hu/images/files/rudejuvoz.pdfIn PDF document text
- http://www.kreasoft.mx/wp-content/plugins/formcraft/file-upload/server/content/files/1612f985f7e863---87711259686.pdfIn PDF document text
- http://lichnyiybrand.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16134287dbeacc---12942866526.pdfIn PDF document text
- http://centralcogtc.com/uploads/file/35317291050.pdfIn PDF document text
- http://kavernoklub.com/campannas/file/13916338995.pdfIn PDF document text
- http://metabolizmusonline.hu/images/upload/file/fomemagewadujubarapeko.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c643.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC643	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000de5a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDE5A	10360 bytes
SHA-256: `dc7fad5d7a50b6512ab82565b5c8bd738e421a11283d08a841a1334d9846681f`
`font_02_sfnt_off0000f5b1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF5B1	18356 bytes
SHA-256: `bb41d1f5bbba7b9315f455564c4b45608a8b2de0df00cce5e659193c0a0a7d9a`

Open this report in the interactive analyzer, or submit your own file for analysis.