PDF malware analysis — malicious · a545276725b2f7e2

MALICIOUS

PDF

81.8 KB Created: 2021-09-24 00:55:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25

MD5: 614bc67c2f2324a2e10cd0889948c060 SHA-1: 55720e51b64b53047c50a11a6b7bf4038684a4f3 SHA-256: a545276725b2f7e2a206a1c69619ef51777d098f3bcc65de5ccf823ccbbdbf06

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV, indicating it's a Pdf.Phishing.Trojan. It contains a link farm pointing to multiple disposable or compromised domains, suggesting an attempt to redirect users to malicious content. The presence of embedded URLs and the heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly indicate a phishing or malware distribution scheme.

Machine Learning

Nyx PDF Classifier suspicious score 0.3778

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://curvy.tw/upload/files/24557141766.pdf In PDF document text
- http://sbsinternationalschool.org/userfiles/file/buseno.pdfIn PDF document text
- http://svatba-emi.com/uploads/pages/files/2471129505.pdfIn PDF document text
- http://amako-ra.com/wp-content/plugins/super-forms/uploads/php/files/e29cad64ed72cce9c0aa3cf64deadec3/94567458532.pdfIn PDF document text
- https://theipbuzz.com/images/file/lejuvuwuwodexi.pdfIn PDF document text
- https://www.bouwenaaneensterkwerkgeversmerk.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16144a0eb34c5e---81785646525.pdfIn PDF document text
- http://yossy.biz/userfiles/file/81717866709.pdfIn PDF document text
- https://sausalito.com/wysiwygfiles/file/tagisixowalasozedanoj.pdfIn PDF document text
- https://globaldreamindia.com/webcms/file/9158427306.pdfIn PDF document text
- https://www.popcaffe.it/wp-content/plugins/super-forms/uploads/php/files/f13e06d9bd2c22cf0ff3b3e14731fd8a/98829067125.pdfIn PDF document text
- http://hotelbasantresidency.com/uploads/69728590649.pdfIn PDF document text
- https://umartravel.com/files/dirukapu.pdfIn PDF document text
- https://www.bnbtravels.com/ckfinder/userfiles/files/45492006007.pdfIn PDF document text
- http://area100impianti.it/userfiles/files/9984089817.pdfIn PDF document text
- http://ewhamd.net/upFiles/ckeditor/files/gebufasasijib.pdfIn PDF document text
- http://phongthuydotho.vn/upload/files/ginobab.pdfIn PDF document text
- https://www.frontieregypt.com/sites/all/libraries/ckfinder/userfiles/files/bufolo.pdfIn PDF document text
- http://altus.pl/userfiles/file/kiseruwawekawozegujatifir.pdfIn PDF document text
- http://originalbau.hu/imagesfiles/50100312792.pdfIn PDF document text
- https://escolaalfa.com/userfiles/file/8854909648.pdfIn PDF document text
- http://luckyassessoria.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1613e390d0c877---73841209894.pdfIn PDF document text
- http://www.insurancedirectcanada.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16137488b68f5d---61627786616.pdfIn PDF document text
- http://mensagemcrista.com.br/ckfinder/userfiles/files/37063219950.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=strunk+and+white+elements+of+style+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f509.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF509	18380 bytes
SHA-256: `8096966170dc3a05c388b540893f4293f919ab5ac01b0f67f430920841154ac9`
`font_01_sfnt_off00012506.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12506	11228 bytes
SHA-256: `70b2d032a94fa5c80901a9ed13ce89dcab4501fc3801bb7f781de26d6a06a21d`

Open this report in the interactive analyzer, or submit your own file for analysis.