PDF malware analysis — malicious · 99587c19bb2cb027

MALICIOUS

PDF

76.2 KB Created: 2021-09-05 06:15:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16

MD5: a6839419232d5214f1485100f4e720f3 SHA-1: f22a5608673b13f7ad5dd27ed87dedecbb491f8d SHA-256: 99587c19bb2cb02799c6b23f8342ec28779c6cd7dd5f608d94a9bd96dd117ec4

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file contains a large number of external links, many of which point to other PDF files hosted on compromised websites. The ClamAV heuristic identifies it as a phishing trojan, suggesting the links are intended to lure users into downloading malicious content. The presence of PDF_SEO_DISPOSABLE_LINK_FARM and PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM heuristics further supports the interpretation of this file as a distribution point for malicious documents.

Machine Learning

Nyx PDF Classifier suspicious score 0.4750

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://accessibilite-salle-eau.com/ckfinder/userfiles/files/92149949301.pdf In PDF document text
- https://ailani.org/wp-content/plugins/super-forms/uploads/php/files/da0e6c9c0f77da56bddab64ab1555d4a/81229858215.pdfIn PDF document text
- http://pickup-ws.com/userfiles/files/3719749680.pdfIn PDF document text
- https://carthink.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607ebc080f01b---76133861499.pdfIn PDF document text
- http://risorsaterra.it/userfiles/files/6148045687.pdfIn PDF document text
- https://alcc.vn/wp-content/plugins/super-forms/uploads/php/files/52qngkvepak8o5esiq3nr9i90f/mofoxe.pdfIn PDF document text
- https://datenglagi.com/contents/files/21402189559.pdfIn PDF document text
- http://saamfactory.com/wp-content/plugins/super-forms/uploads/php/files/5ff540494214fac5b77ee24b8570645f/xibujogurudegerevafuxali.pdfIn PDF document text
- https://amblamy.ee/upload/file/88765618592.pdfIn PDF document text
- https://www.olympusnorge.no/wp-content/plugins/super-forms/uploads/php/files/0l64pd8dk1nsvm0mif2mq9j0kq/kibawi.pdfIn PDF document text
- http://www.rlktechniek.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c164d3b7cb9---39204330111.pdfIn PDF document text
- http://aiskreunion.com/clients/b/b4/b417c2091670ce0b0d78f4b231aea02c/File/mufopekewenu.pdfIn PDF document text
- https://www.nobleorthodontic.com/wp-content/plugins/super-forms/uploads/php/files/d0a8cadfc05ea13d73831f918a355ccb/dupuwigijus.pdfIn PDF document text
- http://www.danvillern.com/wp-content/plugins/super-forms/uploads/php/files/5tftci6tqvir1hrk85fein4365/92122803201.pdfIn PDF document text
- http://cageart.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160ad00359d430---suwobexukirew.pdfIn PDF document text
- http://firewheels.pe/userfiles/file/53916027024.pdfIn PDF document text
- http://www.canadavisaservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160830bdb190aa---26992999486.pdfIn PDF document text
- http://trungtinjsc.vn/upload/FCK/file/faserisavoxolagivojep.pdfIn PDF document text
- https://chennothinterios.com/uploads/file/godibudedawadepazolidenu.pdfIn PDF document text
- http://eprdel.cz/userfiles/file/72128119239.pdfIn PDF document text
- https://alemarferries.alemarsnp.gr/ckfinder/userfiles/files/83108859974.pdfIn PDF document text
- http://wirheiraten.de/images/file/26628713955.pdfIn PDF document text
- http://hoteldanang.vn/uploads/images/files/rojuleruxuxefiloliwo.pdfIn PDF document text
- http://xn--o39a91gvwm83kbsn.com/FileData/ckfinder/files/20210715_CF42A0151BD0C411.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/PmAiG5ZyT-k/uplcv?utm_term=shawl+crochet+pattern+free+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dbc2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDBC2	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000f3d4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF3D4	17144 bytes
SHA-256: `506c124c54505f79297fef31ba67417b38af7804e69956731d68565e31ec5e72`

Open this report in the interactive analyzer, or submit your own file for analysis.