PDF malware analysis — malicious · 93a6aef83c50936f

MALICIOUS

PDF

86.6 KB Created: 2021-08-16 14:03:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07

MD5: 728538c08b1f5ff438d9e7a2ae38e96d SHA-1: 88fa15c66bb56f1bc3a750df1b3b1fdb3d3eddf7 SHA-256: 93a6aef83c50936ff646ecddf681a703c0457b79b5b8cc935a16f0ff183b9b5c

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics as malicious, including a high-confidence ML classifier and ClamAV detection. It functions as a link farm, containing numerous URLs pointing to compromised WordPress installations and other disposable hosting. These links likely lead to phishing pages or further malware downloads, indicating a malicious intent to lure users to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9974

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://oniceh.ru/uplcv?utm_term=cd+cover+print+size+template PDF link annotation
- https://markzone.az/wp-content/plugins/super-forms/uploads/php/files/hvko95fcj9dtie3o602a9fo3ao/zodefewovag.pdfIn PDF document text
- https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/1609dbdc72df3d---61391555931.pdfIn PDF document text
- https://bczenekar.hu/files/file/wupelaza.pdfIn PDF document text
- https://www.denisonlandscaping.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ddee89a156b---jegoxadagitajogi.pdfIn PDF document text
- http://kleinschaden-expert.de/userfiles/file/56150485841.pdfIn PDF document text
- http://trainternational.in/wp-content/plugins/formcraft/file-upload/server/content/files/160afa77200887---wadoto.pdfIn PDF document text
- https://mebelpozakazu.ru/wp-content/plugins/super-forms/uploads/php/files/9a7049198f021d889d19062fd8189bd9/4884783128.pdfIn PDF document text
- http://www.tenniscanberra.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160b6f1d115013---zasip.pdfIn PDF document text
- https://ltgtrends.com/wp-content/plugins/super-forms/uploads/php/files/db722313d5ced4a81f63fa93be9ff2ae/rolugedisezedamudemodobi.pdfIn PDF document text
- http://legalinet.eu/userfiles/files/lewosegufafonexekupun.pdfIn PDF document text
- https://www.ediliziaindustriale.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb9e1a33426---gavebawabamejuber.pdfIn PDF document text
- https://www.davidcosz.de/wp-content/plugins/super-forms/uploads/php/files/laorgd5fjlgsbi86nfccrocl9d/45791576324.pdfIn PDF document text
- https://storage-in-motion.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609695b1eb72d---97899484291.pdfIn PDF document text
- http://www.191seo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c94a9fb4164---3751467851.pdfIn PDF document text
- https://www.pennlighting.com/wp-content/plugins/super-forms/uploads/php/files/e9ef40305336d37cf81a6aa28e608d1c/foparudovotidikokesud.pdfIn PDF document text
- http://capmar.eu/userfiles/file/namivu.pdfIn PDF document text
- http://www.bufolari.com/public/immagini/file/bomejo.pdfIn PDF document text
- http://atsrealtyvietnam.com/upload/files/64056493950.pdfIn PDF document text
- https://areicon.com/images/file/xofubabimopelugu.pdfIn PDF document text
- http://hyundaiokla.com/uploads/files/1596606575.pdfIn PDF document text
- https://detectiveoffice.net/userfiles/file/93726129551.pdfIn PDF document text
- http://le-lemniscus-incandescent.fr/ckeditor/upload/files/86989340160.pdfIn PDF document text
- http://robertfeinberglaw.com/images/edit_images/file/sozotadiminoferojodere.pdfIn PDF document text
- http://hongdacable.com/d/files/xabapavijajewinumixezobek.pdfIn PDF document text
- http://analogsys.com/uploaded/file/31509337560dc0d7a7a139.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eb89.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB89	10832 bytes
SHA-256: `b4f5bf9cd62c9d397d2d3022c7164953df4cd7b97f221f6b49cc87bb2fe2a360`
`font_01_sfnt_off0001048d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1048D	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00011c9f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11C9F	19016 bytes
SHA-256: `a3a99030adce3417e095f121fdc4efdda52caa8a8afb8f81223797a2de73e945`

Open this report in the interactive analyzer, or submit your own file for analysis.