PDF malware analysis — malicious · a1ceafe0647860b8

MALICIOUS

PDF

82.3 KB Created: 2021-09-08 00:55:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07

MD5: decbdd786e1b4be9a01446bfeb55dec4 SHA-1: cee711be575bf2e2f4e2187dbe0a7375d637e83a SHA-256: a1ceafe0647860b82d92275536045925df4eac60781b902355d04f7b0593d9b5

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external links, many pointing to compromised WordPress sites, suggesting a link farm or phishing lure. The presence of PDF_URI and PDF_SEO_DISPOSABLE_LINK_FARM heuristics further supports this, indicating the PDF is designed to redirect users to potentially harmful external content. No scripts were extracted, but the overall structure and heuristics point to a phishing or malware distribution campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.9917

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://oniceh.ru/uplcv?utm_term=jesus+paid+it+all+lyrics+and+chords+pdf PDF link annotation
- http://indemo.pl/Image/files/11664559802.pdfIn PDF document text
- https://viajespereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073ac320b1c2---pevepugamamugavumefit.pdfIn PDF document text
- http://happinessgown.com/upload/users/files/sazaluxovijun.pdfIn PDF document text
- http://www.hkwebdesign.com.hk/wp-content/plugins/formcraft/file-upload/server/content/files/160badc2184f4c---piboxidusupudanafaw.pdfIn PDF document text
- http://bptramptour.pl/files/file/buronavagagitodupapezop.pdfIn PDF document text
- https://relaxationplusmn.com/wp-content/plugins/super-forms/uploads/php/files/93a982975bf65beb553c69db0fd36010/77518260551.pdfIn PDF document text
- http://2girlstrippin.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c86db5bbf6---xeduminokuxakanazuxeju.pdfIn PDF document text
- https://ecef-groupe.com/wp-content/plugins/super-forms/uploads/php/files/c9inb567apo0v5ale0v2n4eeb0/xesajanasekolixegamekibur.pdfIn PDF document text
- http://kraljicabih.com/wp-content/plugins/formcraft/file-upload/server/content/files/160834961e8f78---30327521587.pdfIn PDF document text
- https://relaxationplusmn.com/wp-content/plugins/super-forms/uploads/php/files/d2cf90eb3a57c988e04814e3fbd4b6a4/nufoburavubib.pdfIn PDF document text
- http://top-conversion.ru/ckfinder/userfiles/files/6661563163.pdfIn PDF document text
- https://www.hintonassociates.com/wp-content/plugins/super-forms/uploads/php/files/25a0c01e08611c1a4c18eaa378d9dd44/fakitiwezodudobipeva.pdfIn PDF document text
- https://motelandratecuci.ro/userfiles/file/37856529835.pdfIn PDF document text
- https://sindhuinvestment.com/ckfinder/userfiles/files/54008975894.pdfIn PDF document text
- https://songhong.info/userfiles/file/susibiwivugezazige.pdfIn PDF document text
- https://vickers-electronics.co.uk/wp-content/plugins/super-forms/uploads/php/files/3cc9e3998705fb8db494991d7f8c8806/64752661820.pdfIn PDF document text
- https://goldengrowers.com/wp-content/plugins/super-forms/uploads/php/files/8712be4b69c7c387267872512d6f4120/fadifivez.pdfIn PDF document text
- https://biomedchita.ru/imeg_master/file/faxezuwozabojofapededubir.pdfIn PDF document text
- https://aiwatopup.com/ckfinder/userfiles/files/9144310956.pdfIn PDF document text
- http://gustosandvic.com/ckfinder/userfiles/files/2486924963.pdfIn PDF document text
- http://www.gametimecatering.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a38d59b040b---jigoru.pdfIn PDF document text
- http://www.commandinglife.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606e69eb2c5e4---83058361334.pdfIn PDF document text
- https://www.golddustdental.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f7ec0587a5---musuzamalazov.pdfIn PDF document text
- https://www.jemelectric.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aa5b92c6509---2511054641.pdfIn PDF document text
- https://burkina-businessschool.com/business_school/uploads/file/34548435383.pdfIn PDF document text
- https://www.stamfordtaxis.com/wp-content/plugins/super-forms/uploads/php/files/cjovu2r462uo3rabcq23300auj/wovazizurigelajazivire.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000da84.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDA84	10920 bytes
SHA-256: `4cf957acb08ae0b98f9ce05a507e806b8c111c53ba9e5591b225698b29dc70a1`
`font_01_sfnt_off0000f3c8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF3C8	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00010bda.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10BDA	18116 bytes
SHA-256: `99159aa4aaae8c63e5bef77cf5dcc57f4c1e146bab6ca739b8552dee9a81f744`

Open this report in the interactive analyzer, or submit your own file for analysis.