PDF malware analysis — malicious · af3d8c59625a9beb

MALICIOUS

PDF

81.7 KB Created: 2021-07-17 16:15:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11

MD5: c3ccc521d86a01b3c5420daee5308c4f SHA-1: 87f794d2f92e3f3b79cd38befd0511056bf19f33 SHA-256: af3d8c59625a9beb6d0929e4d248ee71570b2d947210e8291d5388464a704229

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains numerous links, many pointing to compromised websites and disposable hosting, indicating a link farm designed to redirect users. The ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggests a phishing or malware distribution intent. While no scripts were explicitly extracted, the nature of the URLs and the heuristic firings point towards a malicious document likely used as part of a phishing campaign.

Machine Learning

Nyx PDF Classifier suspicious score 0.4749

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://upoart.com/ckfinder/userfiles/files/letaduvuterofife.pdf In PDF document text
- http://www.adatechotomasyon.net/wp-content/plugins/formcraft/file-upload/server/content/files/1607a2c1dc742e---nejitaduzekisipifabizij.pdfIn PDF document text
- https://tepihtrava.rs//files/85358552166.pdfIn PDF document text
- http://www.nanodrywash.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e76ce1341d0---42954875916.pdfIn PDF document text
- https://lawyerupsmart.com/tempimg/file/8615859658.pdfIn PDF document text
- http://angarakshaksecurity.com/userfiles/file/37656602824.pdfIn PDF document text
- https://wacee.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b8ac244cb96---38970941273.pdfIn PDF document text
- http://ridendo.cz/files/file/temawujekoj.pdfIn PDF document text
- http://headrepublic.pl/images/files/lilidazitumosat.pdfIn PDF document text
- https://www.limratechnologies.net/wp-content/plugins/formcraft/file-upload/server/content/files/1609954f60c8a2---1677495606.pdfIn PDF document text
- https://www.demetagras.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079bb49df968---povovaju.pdfIn PDF document text
- http://laros.cz/UserFiles/file/37770284611.pdfIn PDF document text
- https://avigailpekelman.com/sites/default/files/file/66582469807.pdfIn PDF document text
- http://abpaluso.com/upload/file/jelup.pdfIn PDF document text
- https://sakitonus.ru/wp-content/plugins/super-forms/uploads/php/files/f88479b189460bcfca3e98f989170b4d/9667368965.pdfIn PDF document text
- https://prikolnaya.com/wp-content/plugins/super-forms/uploads/php/files/937323f7ed40d2d88262aa24370a697b/wipufusadeworugapezitetam.pdfIn PDF document text
- https://www.ayersworthglen.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609d290d62096---17406850902.pdfIn PDF document text
- https://ols.lighting/wp-content/plugins/super-forms/uploads/php/files/87c8cc697fca657011340baa6b9844dc/81264094118.pdfIn PDF document text
- http://coss-wynn-reunion.com/clients/d/db/dbe3622004495b304d8703879a486b7d/File/toguvuviruwasigejiluwa.pdfIn PDF document text
- https://www.bouwenaaneensterkwerkgeversmerk.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160cc0d3355c2b---19606047756.pdfIn PDF document text
- http://multiseal.com.ph/wp-content/plugins/formcraft/file-upload/server/content/files/16073d828080c9---64448914309.pdfIn PDF document text
- http://coreaad.com/DreamDataUpload/file/nisewemofetejudufip.pdfIn PDF document text
- http://www.redactordecontenidos.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160bfb708db7e5---wezevoluw.pdfIn PDF document text
- https://blackknowledge.com/wp-content/plugins/super-forms/uploads/php/files/732f8e845c639db635dfb2b68fb9a8c2/46190746096.pdfIn PDF document text
- https://maugli24.ru/wp-content/plugins/super-forms/uploads/php/files/4e9ea306f5d3045404422a0c1b258c30/xixodulado.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=texas+license+replacement+application+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ecae.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xECAE	10848 bytes
SHA-256: `7d780109c1a3ad690dadad1d4faa6a11fc5d4a2e6cb89425c541acb8643e18e7`
`font_01_sfnt_off000105bc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x105BC	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00011dce.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11DCE	19176 bytes
SHA-256: `5027ab42efc99202318333dbc452bcfb95630b8ff5f57d1b2643854c4df37f81`

Open this report in the interactive analyzer, or submit your own file for analysis.