PDF malware analysis — malicious · 984972f020fdd784

MALICIOUS

PDF

83.3 KB Created: 2021-09-04 18:49:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23

MD5: e8caeb6c9cca4fd07948119b09fc8278 SHA-1: a91c72f476a9c4a19f895ca012ecf67ad1550df1 SHA-256: 984972f020fdd784972663cc585eb8d28112ab552e4751367ffaa41790e95336

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as malicious by ClamAV and an ML classifier, exhibiting characteristics of a link farm. It contains numerous URLs pointing to compromised CMS uploads and disposable hosting, suggesting an attempt to lure users to external sites. The PDF structure and embedded URLs indicate a phishing or redirection attack.

Machine Learning

Nyx PDF Classifier malicious score 0.9912

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.swx.global/wp-content/plugins/super-forms/uploads/php/files/8f18ad42c167b518aed14d69a5d28732/60713334973.pdf In PDF document text
- http://johnlillylaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/tizowaram.pdfIn PDF document text
- http://smolninskayahotel.com/userfiles/file/84622455535.pdfIn PDF document text
- https://aquariumfargo.com/wp-content/plugins/super-forms/uploads/php/files/672c4f9d650c2c7d354d9cca8920b608/jesalizigesufapadejagotu.pdfIn PDF document text
- http://ecohost.ru/pics/images/file/wirefawegif.pdfIn PDF document text
- http://iamsoldierfit.com/wp-content/plugins/formcraft/file-upload/server/content/files/16094799905b43---79385653566.pdfIn PDF document text
- https://www.dekleinewerf.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160b8c917cf39a---7822707127.pdfIn PDF document text
- http://sklepjola.pl/userfiles/file/bedemojikonupubamet.pdfIn PDF document text
- https://amagi.la/wp-content/plugins/formcraft/file-upload/server/content/files/160ac1f138d8ad---wuwibamugudixawefeta.pdfIn PDF document text
- http://bjallstar.com/upload/file/monofuz.pdfIn PDF document text
- http://chothuexehochiminh.com/userfiles/file/76326151911.pdfIn PDF document text
- http://www.k-24.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609858294848f---73275563817.pdfIn PDF document text
- https://rebates.forex/wp-content/plugins/super-forms/uploads/php/files/33lvrq7mo1eh50fv567ukola80/74844625399.pdfIn PDF document text
- http://cedresarquitectura.com/wp-content/plugins/formcraft/file-upload/server/content/files/16092a8e3842a2---dilarumufadevededavevu.pdfIn PDF document text
- http://mail.teleserviciomalaga.com/ckfinder/userfiles/files/87204836184.pdfIn PDF document text
- http://aiskreunion.com/clients/b/b4/b417c2091670ce0b0d78f4b231aea02c/File/fazipalikeramute.pdfIn PDF document text
- https://www.web2business.pt/wp-content/plugins/formcraft/file-upload/server/content/files/160a5255531650---gikomusivubedasosone.pdfIn PDF document text
- http://hoggard1975.com/clients/a/a4/a43fc1111b7ad4318f8b553feb79a890/File/fozibomilawefadenege.pdfIn PDF document text
- https://sdyh.gr/wp-content/plugins/super-forms/uploads/php/files/9scjc4g9e34i963heasta4ptr1/38045450184.pdfIn PDF document text
- https://livingcircles.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1607e107e84b80---39839850312.pdfIn PDF document text
- https://grancom.by/upload/docs/84464500349.pdfIn PDF document text
- https://nbcmedia.vn/ckfinder/userfiles/files/pegobo.pdfIn PDF document text
- http://karate-talence.com/newsite/userfiles/files/39717574071.pdfIn PDF document text
- http://www.infranetltd.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609219f27c413---59528603346.pdfIn PDF document text
- https://stgeorgedentalcare.in/ckfinder/userfiles/files/21653380135.pdfIn PDF document text
- https://anandamsanyal.com/userfiles/file/2633717943.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=apostila+auxiliar+de+necropsia+pdf+gratis+rjPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dd15.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDD15	11108 bytes
SHA-256: `34e8546bb802d76adae0197f77aa40006d0e0056b76172cc4c785f960c23a491`
`font_01_sfnt_off0000f6f1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF6F1	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00010f03.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10F03	19856 bytes
SHA-256: `d53bd1c1fe5bccc8564b8ec8f30cc7b29d2ec918948c05dd402a826796829775`

Open this report in the interactive analyzer, or submit your own file for analysis.