PDF malware analysis — malicious · ac2a3819497e715d

MALICIOUS

PDF

79.4 KB Created: 2021-09-12 05:09:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11

MD5: 24c28ea4f7e63aa6725741fedc9e2590 SHA-1: d32db0d5609d7a481593012e47b178a44345398e SHA-256: ac2a3819497e715d7024dbb96ace81651bc85ba42be43ececc69319cf0cb3bcb

164 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and numerous external links, many of which point to compromised WordPress sites or disposable hosting, indicating a link farm designed to distribute malicious content. The ML classifier and ClamAV detection strongly suggest malicious intent, likely phishing or malware delivery. The embedded JavaScript is a common technique for exploiting PDF vulnerabilities or redirecting users to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9953

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://osakaav.com/userfiles/files/63010254868.pdf In PDF document text
- https://phunhai.net/upload/files/raxulososekinixagowijofew.pdfIn PDF document text
- http://contactfm.be/userfiles/files/semuranun.pdfIn PDF document text
- https://brincandoeaprendendo.com/fotosempresa/files/23289537644.pdfIn PDF document text
- https://lisacutler.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612f8920352ca---42280863418.pdfIn PDF document text
- https://dodomacnosti.net/data/file/84977043007.pdfIn PDF document text
- https://pelicanfinancialnetwork.net/ckfinder/userfiles/files/51781451620.pdfIn PDF document text
- https://fotoprint.lv/downloads/file/wokufenuwoxizapajigafoj.pdfIn PDF document text
- http://nuovartea.eu/userfiles/files/930550968.pdfIn PDF document text
- https://ambalatender.com/upload/files/wojujakefujiwap.pdfIn PDF document text
- https://hotararicedo.ro/files/files/kusakabede.pdfIn PDF document text
- http://sowa-architekci.pl/userfiles/files/7900376262.pdfIn PDF document text
- http://vp-dmsh.ru/admin/ckfinder/userfiles/files/juwuwufupopozakuragef.pdfIn PDF document text
- https://actsonics.com/uploads/files/202109011333541461.pdfIn PDF document text
- http://nawaress.com/webroot/js/ckfinder/userfiles/files/47352290614.pdfIn PDF document text
- https://regenerativetherapyforpain.com/wp-content/plugins/super-forms/uploads/php/files/dd25206c9858778ea5382445e51e1538/11713942231.pdfIn PDF document text
- http://myphamasia.net/upload/files/92406556050.pdfIn PDF document text
- http://www.pattyn360.com/upload/forum/files/63171271097.pdfIn PDF document text
- http://carscaso.com/js/upload/files/pimusem.pdfIn PDF document text
- http://in-dapt.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612fba3531829---73077006815.pdfIn PDF document text
- https://curvy.tw/upload/files/wijomogifovomuj.pdfIn PDF document text
- https://7mark3t2-7aya.com/contents/files/gepamawusobof.pdfIn PDF document text
- http://prakseologia.eu/userfiles/file/luxovawofenebozofi.pdfIn PDF document text
- https://yuktiedu.com/wp-content/plugins/super-forms/uploads/php/files/0a4115d0b00edd5acb4bcfeda839e2b6/27827959718.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=networking+fundamentals+book+pdfPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ce52.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCE52	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000e664.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE664	18472 bytes
SHA-256: `cde227453b05d2ef5104b89cfda201af33cae1990f60f5bf6f73d21e32280b22`
`font_02_sfnt_off0001165a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1165A	11236 bytes
SHA-256: `3a6bca53c3f99e4eaab21704b1fcfe8ae639ff8bc1f8501d69c8946d2a8675fc`

Open this report in the interactive analyzer, or submit your own file for analysis.