PDF malware analysis — malicious · 8e1f2da60995f2a3

MALICIOUS

PDF

77.7 KB Created: 2021-07-08 10:47:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11

MD5: 0edc9a94fffcce5d248086db4f84ccfb SHA-1: abcbf905af8d082dc5cb7b2efc9cc5d513e72122 SHA-256: 8e1f2da60995f2a36f164391b733e3b5d4a1920808d56f325e1b672053da38c4

164 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and a machine learning classifier. It contains embedded JavaScript and a significant number of external URIs, many of which point to compromised CMS uploads or disposable hosting, forming a link farm. The embedded JavaScript likely serves to obfuscate the malicious intent or to initiate a redirect to one of the listed URLs.

Machine Learning

Nyx PDF Classifier malicious score 0.9972

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://garglob.ru/uplcv?utm_term=9th+guide+social+science PDF link annotation
- http://skyrun-arser.com/js/fckeditor/editor/filemanager/connectors/php/connector.php/upfiles/file/210706052603837778asf39d.pdfIn PDF document text
- https://www.enterpriselighting.com/wp-content/plugins/super-forms/uploads/php/files/b82f362642a35abf8ac9f69146e33d00/99843042725.pdfIn PDF document text
- http://chemonova.com/FCKeditor/file/nuvejaligoki.pdfIn PDF document text
- http://dabien.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/1607473209ccf3---vomototitibumosetaxemi.pdfIn PDF document text
- http://brodart01.com/wp-content/plugins/super-forms/uploads/php/files/62ikh8d43i5i2ur2tr51e1fvbh/fedijegadomiliroxipu.pdfIn PDF document text
- http://www.benvenutialmare.com/wp-content/plugins/formcraft/file-upload/server/content/files/16096f9dfa6d5c---58154444327.pdfIn PDF document text
- http://www.maoles.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bbc4284f18c---17797937762.pdfIn PDF document text
- https://myupfield.link/wp-content/plugins/super-forms/uploads/php/files/pvdp4vecnkjf72ollmtjgnsn3a/8114432948.pdfIn PDF document text
- https://sketchup360.vn/wp-content/plugins/super-forms/uploads/php/files/otcpc16mf5h5m5qs4s7nlmv7iq/2907112120.pdfIn PDF document text
- https://catbasailing.com/upload/fck/file/tavezajugeto.pdfIn PDF document text
- https://www.scanworld.se/wp-content/plugins/formcraft/file-upload/server/content/files/160923733c6d79---6484400155.pdfIn PDF document text
- https://primeodontorj.com/wp-content/plugins/super-forms/uploads/php/files/420003b6f371a3a85f187e96ab86b3d4/41139858254.pdfIn PDF document text
- http://www.dfdtrading.sk/ckfinder/userfiles/files/78282299775.pdfIn PDF document text
- https://www.caesarstravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d25d1c996ba---litemenavojiduwixaremafe.pdfIn PDF document text
- http://uk-finansist.ru/userfiles/file/40882571533.pdfIn PDF document text
- https://hanahana.vn/media/ftp/file/64004592406.pdfIn PDF document text
- http://ketoanantamhcm.com/uploads/files/mawuzedejefezakeketavefe.pdfIn PDF document text
- https://aldea.work/wp-content/plugins/super-forms/uploads/php/files/46fc9d33aeff0cb7eee6fdbd52cb657c/88336347674.pdfIn PDF document text
- https://fobiy.net/wp-content/plugins/super-forms/uploads/php/files/c3b77e3bf2a100bf04d6fa6ca01220ff/weludefozafux.pdfIn PDF document text
- https://arenda1s.ru/wp-content/plugins/super-forms/uploads/php/files/d5faf114d908ad9f9470626257ef3750/25222464324.pdfIn PDF document text
- http://www.northeastmarquees.com/wp-content/plugins/super-forms/uploads/php/files/78e1561487b6475f23a952fb5733bd8f/bonazujuseluzalapunamom.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cfa8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCFA8	16144 bytes
SHA-256: `7da5ba6cf2b7a9aabce8d58989918eb1a026ba7e9ce08d678eab2e0d519c4131`
`font_01_sfnt_off0000f96d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF96D	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00011184.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11184	10720 bytes
SHA-256: `5a2b125c87b4aa1e88f02b9b61c39b8f24874620db1236fa547601f01822dcef`

Open this report in the interactive analyzer, or submit your own file for analysis.