PDF malware analysis — malicious · b05624a312328461

MALICIOUS

PDF

78.5 KB Created: 2021-09-07 06:15:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07

MD5: b15bbb603665f94f4878e0bbec17012a SHA-1: 297bbcd8f35df74b26e674ebafe78c9e27e8defa SHA-256: b05624a312328461123d53c5fb6f65abd48a7dd2cf32bcc88b9ca2c251b727ec

164 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains embedded JavaScript and a link farm pointing to compromised WordPress sites, suggesting it's designed to lure users to malicious content. The presence of multiple links on disposable hosting and compromised upload storage further supports a phishing or malware distribution scheme.

Machine Learning

Nyx PDF Classifier malicious score 0.9975

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.ikedatosou.com/wp-content/plugins/formcraft/file-upload/server/content/files/160979c4abded2---fezinomimigigewere.pdf In PDF document text
- http://tcsm62.org/uploads/news/file/81192744243.pdfIn PDF document text
- https://sevsport.info/wp-content/plugins/super-forms/uploads/php/files/4a7c8b45ce27267142d4924081a2a7ab/guzazisadam.pdfIn PDF document text
- https://gachbinhduong.com/upload/file/21631345159.pdfIn PDF document text
- http://sooam.com/files/fckeditor/file/19615855086120325d276fa.pdfIn PDF document text
- http://staractivecollection.com/resimler/site/files/77435682292.pdfIn PDF document text
- http://jointrilogy.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090833309a75---31718048549.pdfIn PDF document text
- https://velvetskin.pl/wp-content/plugins/super-forms/uploads/php/files/c8fce3533608f3788c3bbdbec1284c06/58396222613.pdfIn PDF document text
- https://www.charroninc.com/wp-content/plugins/super-forms/uploads/php/files/f0fdfff6bb33c7bd297a400e478a4527/46320236426.pdfIn PDF document text
- https://bataretak.com/img/files/file/22681766195.pdfIn PDF document text
- http://verdantnorwich.com/clients/3/30/306756bb587dffcd11ca74610d845a16/File/13159235056.pdfIn PDF document text
- https://xn--80aaa1anac6cg.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/908431729c4e15aa421cd2fe99aa6581/31505173406.pdfIn PDF document text
- http://sobinco.cz/ckfinder/userfiles/files/62502838838.pdfIn PDF document text
- http://subventionsbetrug.de/wp-content/plugins/super-forms/uploads/php/files/kagfk6ns5f7eqpivb29n1hmpor/wegemufedimisafekek.pdfIn PDF document text
- http://kaplanpm.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612cd9b84ffa9---tudibezanapiwubalijoj.pdfIn PDF document text
- http://park-seversk.ru/other/js/ckfinder/userfiles/files/69705823089.pdfIn PDF document text
- https://www.masismarketing.com/wp-content/plugins/super-forms/uploads/php/files/cfa571091cdf6bd722f4c18390129791/34172793041.pdfIn PDF document text
- http://equipociclistaugeraga.com/ciclistas/userfiles/file/37716777922.pdfIn PDF document text
- https://www.costaverde.it/wp-content/plugins/formcraft/file-upload/server/content/files/160f8f57f7c093---kapelig.pdfIn PDF document text
- https://recapress.com/ckfinder/userfiles/files/vererukixirad.pdfIn PDF document text
- http://www.tif.cn/wp-content/plugins/super-forms/uploads/php/files/fjdghbopqcdtrnt20rdvha8jit/motadanazasulu.pdfIn PDF document text
- https://gyn-koe70.de/obrazky/file/wodan.pdfIn PDF document text
- https://soudurelausiere.ca/upload/editor/file/73873472621.pdfIn PDF document text
- https://alnahamgroup.com/userfiles/file/telomirujasapuba.pdfIn PDF document text
- http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1608336287e633---14782323180.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/1KS0DP0cxss/uplcv?utm_term=honeywell+alarm+panel+user+manualPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cebf.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCEBF	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000e6d1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE6D1	17540 bytes
SHA-256: `7c21fc7149f2f01ae660e994bf6b47df7b28e496db75f68c217892f57943d33e`
`font_02_sfnt_off0001141e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1141E	10512 bytes
SHA-256: `21802548302b34a50f9ec39c8fc0bb4408eeeef4cfa85d3bff5a1723d66cb146`

Open this report in the interactive analyzer, or submit your own file for analysis.