PDF malware analysis — malicious · acfe1dfe431a70c2

MALICIOUS

PDF

85.5 KB Created: 2021-09-05 10:37:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27

MD5: 8d2a648d4dc0d715c8c9f01b6671578d SHA-1: 9d2fec389fc46b9e14b5970068a0902a0d668b32 SHA-256: acfe1dfe431a70c2c143dcf4e499beb48527a6311c62b85d75d19b136c9fad72

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It functions as a link farm, with numerous URLs pointing to external sites, many of which appear to be hosted on compromised or disposable domains. The presence of 'utm_term' parameters in some URLs suggests an attempt to track user engagement, common in phishing or malware distribution campaigns.

Machine Learning

Nyx PDF Classifier malicious score 0.9905

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pistant.ru/uplcv?utm_term=sat+subject+verb+agreement+practice+pdf PDF link annotation
- https://zemiigori.com/uploads/file/tozorafemaparanam.pdfIn PDF document text
- https://senfina.top/uploads/files/27862431833.pdfIn PDF document text
- https://humantouchtranslations.com/wp-content/plugins/formcraft/file-upload/server/content/files/1/1606d4632591fb---56571624557.pdfIn PDF document text
- http://homeshopeez.com/uploaded_files/userfiles/files/15810105301.pdfIn PDF document text
- http://www.lebedosapartotel.com/data/yukle/files/9103160342.pdfIn PDF document text
- http://schouteninterieurwerk.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16085fb3620026---garevodokogifukive.pdfIn PDF document text
- http://go-pxl.com/uploads/files/39107496417.pdfIn PDF document text
- https://enville.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b760704f90a---97098123122.pdfIn PDF document text
- https://www.harnoordesigns.com/wp-content/plugins/super-forms/uploads/php/files/0jssmoal6ogd49771mqvihjoq1/palodemuk.pdfIn PDF document text
- https://canoe.ro/Extras/ckfinder/userfiles/files/7678759624.pdfIn PDF document text
- https://surupaceanu.ro/ckfinder/userfiles/files/50490012093.pdfIn PDF document text
- http://tauben-buchmeier.de/kleinberliner-schuetzen/userfiles/files/kilegu.pdfIn PDF document text
- https://loskutova.site/wp-content/plugins/super-forms/uploads/php/files/85c0c4e88f6735247e7d0b72e85621a6/jutepuzinekadituwafiwe.pdfIn PDF document text
- https://chaletsuenodesol.de/files/46713945064.pdfIn PDF document text
- https://evpersoneli.net/ev-personeli/file/bukojatuzemonilesuxuku.pdfIn PDF document text
- http://gptools.net/userfiles/file/mudomomanulales.pdfIn PDF document text
- http://www.sevenchurchestour.net/seven/wp-content/plugins/formcraft/file-upload/server/content/files/1609486456e29a---68339422817.pdfIn PDF document text
- https://prtl.pl/userfiles/file/basexujapegagani.pdfIn PDF document text
- https://yastudio.net/wp-content/plugins/super-forms/uploads/php/files/1443e7e55f6f0e47f348e4a5a0fc0adf/77815435901.pdfIn PDF document text
- https://assignmentmart.com/ckfinder/userfiles/files/4004397970.pdfIn PDF document text
- https://bilbox.es/wp-content/plugins/super-forms/uploads/php/files/d814c5c93fa8a8b1dc4abc07154faf2b/22944512400.pdfIn PDF document text
- http://np-laser.com/upload_fck/file/2021-7-2/20210702070626975486.pdfIn PDF document text
- http://goteneplast.se/files/images/file/sikisexelevadem.pdfIn PDF document text
- https://jogamiskolc.hu/ckfinder/userfiles/files/87406248708.pdfIn PDF document text
- https://gemwares.com/userfiles/file/tadebedatadura.pdfIn PDF document text
- http://ganan10.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/160d00f7874364---48255082738.pdfIn PDF document text
- http://call.ae/wp-content/plugins/formcraft/file-upload/server/content/files/160b55fc66e084---61164418874.pdfIn PDF document text
- http://audiomaster.se/wp-content/plugins/formcraft/file-upload/server/content/files/160b8931493b98---gofajiva.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e40b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE40B	19144 bytes
SHA-256: `19748e7ab9b9926a6be9550cf2abb0cd86cb848151750a7b6a9d2c11342d3f35`
`font_01_sfnt_off0001155e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1155E	11308 bytes
SHA-256: `0631fa177f91a579da5e7d38d07226078516fd47faabf90c7f35fc7acc610798`
`font_02_sfnt_off00012f87.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12F87	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.