PDF malware analysis — malicious · 92dbf6513a486afc

MALICIOUS

PDF

89.5 KB Created: 2021-09-07 15:11:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14

MD5: 6fd3e77891fdec4b3f3b0357ed7d9ed4 SHA-1: 4275a974ec6d0ceb3824d1cc59d2cfffb27bdc98 SHA-256: 92dbf6513a486afcc1d6b5dbd6995d6901063dd97cb1bc1fc57021d8d4a5cdf8

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a link farm pointing to multiple compromised WordPress sites, suggesting a phishing or malware distribution lure. While no scripts were directly extracted, the PDF structure and embedded links are indicative of a malicious document, likely delivered as a spearphishing attachment.

Machine Learning

Nyx PDF Classifier malicious score 0.9913

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.hospedeagora.com.br/wp-content/plugins/super-forms/uploads/php/files/4h4toefc6ror6m1j6pcmibn4s8/tepodotowuxifivozowunef.pdf In PDF document text
- https://cosalesrep.com/wp-content/plugins/super-forms/uploads/php/files/dd7f6b3744009b26a8c0071b6f4cafcf/bereligopofen.pdfIn PDF document text
- https://itandem.net/ckfinder/userfiles/files/mexadabagowosexiwavadik.pdfIn PDF document text
- http://www.moyekolodin.com/files/54893190835.pdfIn PDF document text
- http://brightwayconsultancyservices.com/userfiles/file/futufusadelam.pdfIn PDF document text
- https://encoregallery.us/wp-content/plugins/super-forms/uploads/php/files/b95c253b7e4442a98911c348627c38b1/75033165984.pdfIn PDF document text
- http://www.carolglassman.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c32afeabd1---jubugokabifazuvoti.pdfIn PDF document text
- https://mls.lighting/wp-content/plugins/super-forms/uploads/php/files/bbe5ca1d1d99e64da53385aabb9df0eb/dopizorigatuwo.pdfIn PDF document text
- http://irmascaritasdejesus.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160849a965027b---79700448909.pdfIn PDF document text
- http://xn--spreewaldpension-lbben-9lc.de/meineBilderAlbertGrundschule/file/88415877412.pdfIn PDF document text
- http://marinapogon.pl/upload/file/xedigatusegu.pdfIn PDF document text
- http://www.goldenlantern.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160aecfcfbaf8b---sufimedumetogates.pdfIn PDF document text
- http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160948d42d093f---34875304712.pdfIn PDF document text
- http://vamaconsulting.sk/userfiles/file/57180861714.pdfIn PDF document text
- https://olterus.com/contents//files/47465333409.pdfIn PDF document text
- http://pocatellocampfire.com/wp-content/plugins/super-forms/uploads/php/files/1tur7377udb9l1lbtthrrq4gb0/96899699396.pdfIn PDF document text
- https://gamletaarnhuset.no/wp-content/plugins/formcraft/file-upload/server/content/files/160b02d8497018---nixita.pdfIn PDF document text
- http://www.lebedosapartotel.com/data/yukle/files/2510871586.pdfIn PDF document text
- http://hondaototanan.com/upload/files/60694202123.pdfIn PDF document text
- http://livestocktool.com/d/files/47354778341.pdfIn PDF document text
- https://raiporjai.com/piceditor/file/kedoniwulanapokad.pdfIn PDF document text
- https://gppacdatabase.net/userfiles/file/53620740107.pdfIn PDF document text
- http://getawaynewzealand.co.nz/wp-content/plugins/formcraft/file-upload/server/content/files/160a2af8d8fd3d---59484678474.pdfIn PDF document text
- https://sg-design.top/wp-content/plugins/super-forms/uploads/php/files/9d9de576b5b3a24c5be96e0bdad5768a/85391443136.pdfIn PDF document text
- http://droneducational.com/admin/userfiles/file/nununowifetufuvupavinu.pdfIn PDF document text
- https://manenshop.com/upload/files/samunu.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=comunicacion+interauricular+pdf+cenetecPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f259.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF259	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off00010a70.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10A70	10744 bytes
SHA-256: `dfdad978c635e44e1e804409597e1fac006c96a90b02708e9533e18f13cbeff1`
`font_02_sfnt_off0001231b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1231B	19620 bytes
SHA-256: `e92f12a034d97587c55c9ab77d1dcf7604ef1467d2908e7027a11cc5850c2dbf`

Open this report in the interactive analyzer, or submit your own file for analysis.