PDF malware analysis — malicious · aeeba3e4bf8266b6

MALICIOUS

PDF

87.6 KB Created: 2021-07-08 06:21:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-15

MD5: eabbf39669c1d1fd1db1faa7adbaf739 SHA-1: 4da25d24b98ffccd72b9843dcc2c91f2fd06b6f2 SHA-256: aeeba3e4bf8266b64dc518a5485b78234d612a1a13da37fcde23e0c5caddfc22

196 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous links pointing to compromised WordPress sites, which in turn host other PDF files. This pattern suggests a link farm designed to obscure the ultimate destination, likely a phishing page or malware download. The ClamAV detection and ML classifier strongly indicate malicious intent, consistent with a phishing or trojan delivery mechanism.

Machine Learning

Nyx PDF Classifier malicious score 0.9835

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK

PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://socialchangefactory.org/wp-content/plugins/super-forms/uploads/php/files/25ac4dd8329f5a91a95f6f1386be0682/73180315627.pdf In PDF document text
- https://yournew.site/wp-content/plugins/super-forms/uploads/php/files/g9jfn6q2ndrltb9pufagjo3lfo/woxalodukupuj.pdfIn PDF document text
- https://burragebrothers.com/demo/jolie/beta/userfiles/files/80039499844.pdfIn PDF document text
- https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/0860499de24e4f499a73ab2d44dd9978/71191482501.pdfIn PDF document text
- http://www.gaviprintpack.com/wp-content/plugins/formcraft/file-upload/server/content/files/160acea20d4335---25589815023.pdfIn PDF document text
- https://etonbio.com/newsLetters/images/file/feredin.pdfIn PDF document text
- http://www.rebranded.tv/wp-content/plugins/formcraft/file-upload/server/content/files/160bc36bd09320---taxafof.pdfIn PDF document text
- https://www.adler-leitishofen.de/wp-content/plugins/formcraft/file-upload/server/content/files/16083509c3390b---79343024060.pdfIn PDF document text
- https://facades-et-traditions.com/actualites/file/javetosudipo.pdfIn PDF document text
- http://birons.net/wp-content/plugins/super-forms/uploads/php/files/ddac86254cb04a160ec6649d64e3cdd2/80394636281.pdfIn PDF document text
- http://doublehappyvstheinfinitesadness.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b5c3ff2a530---3874765942.pdfIn PDF document text
- https://moto-trend.cz/public/files/fck/file/xexojuzetenejinopud.pdfIn PDF document text
- http://www.sphotobooth.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cc66eba18c---38260099640.pdfIn PDF document text
- http://snookerfootball.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160abea6b5aa63---sofifajuvaketoxe.pdfIn PDF document text
- https://www.beewellrx.com/wp-content/plugins/super-forms/uploads/php/files/tmp/jeduxajonejo.pdfIn PDF document text
- http://digimaap.com/wp-content/plugins/super-forms/uploads/php/files/9oa4r538cdmnit445g09sa057n/mirujelorusogos.pdfIn PDF document text
- http://strandedtattoo.net/file/vemerekeraxedakorev.pdfIn PDF document text
- http://hattrick-sports.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078fe2cc4565---75228651303.pdfIn PDF document text
- https://vydavatelstvoklett.sk/userfiles/file/72893310498.pdfIn PDF document text
- http://www.luminicaambiental.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac7cc131f6c---68741796913.pdfIn PDF document text
- http://www.maarsehoveniers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16085e888b11a8---jemape.pdfIn PDF document text
- http://sherylrobphotos.com/clients/56056/File/12194466583.pdfIn PDF document text
- https://www.pfgpartners.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1609d04f531192---10608621129.pdfIn PDF document text
- http://cmepta.com/clients/7/74/74ea2f63c40943e6497cbf70acaf7c81/File/6991351497.pdfIn PDF document text
- http://jockmurray.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608938bb78d38---vekewibupup.pdfIn PDF document text
- https://afanasyev-design.ru/wp-content/plugins/super-forms/uploads/php/files/f15abb4a4622e9b1da7666fb8fc57414/senunoxugepavavul.pdfIn PDF document text
- http://philippinesroadshow.com/wp-content/plugins/super-forms/uploads/php/files/4f9188a827ce109624696ca60fb10ac7/34955226844.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=nick+page+solihullPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f23b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF23B	10520 bytes
SHA-256: `280ce92a67d311a462766ac2fda959551ef5bbb14df1e25cb9a33d89d622219f`
`font_01_sfnt_off00010a5c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10A5C	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off0001226e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1226E	17808 bytes
SHA-256: `20f9d50664bcd6c5aa59affcf8d2573338af91c92305fee5f7c9f41bd3dbff04`

Open this report in the interactive analyzer, or submit your own file for analysis.