PDF malware analysis — malicious · b27b0019bb9dbe4e

MALICIOUS

PDF

82.9 KB Created: 2021-09-07 20:47:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24

MD5: 7723dc37e02f47d559c69670a4924eb0 SHA-1: 1a4fd68df1370205155153aec614039daa6374f9 SHA-256: b27b0019bb9dbe4ea1ac98c7db5f3d18b8616d7660e121d4492a897120740df4

184 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was flagged as malicious by ClamAV and an ML classifier. It contains embedded JavaScript and a large number of external links, many pointing to compromised WordPress sites or disposable hosting, suggesting a phishing or malware distribution campaign. The embedded JavaScript likely facilitates the redirection to these malicious URLs.

Machine Learning

Nyx PDF Classifier malicious score 0.9951

Heuristics 8

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTH

A PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://medvor.ru/uplcv?utm_term=purusha+sukta+in+kannada+pdf PDF link annotation
- http://trainternational.in/wp-content/plugins/formcraft/file-upload/server/content/files/160ee51b2d0136---dikopanoza.pdfIn PDF document text
- http://levotst.com/uploads/files/48586165231.pdfIn PDF document text
- http://bogieclassof67.com/clients/71235/File/sefazeli.pdfIn PDF document text
- https://teenvolunteer.org/wp-content/plugins/super-forms/uploads/php/files/8b444954eb20cb5726742c01af776fde/dezinuzewiriviwijebedu.pdfIn PDF document text
- http://cjatkinson.com/userimages/4195020338.pdfIn PDF document text
- http://zoekidsworld.com/userfiles/file/16778043947.pdfIn PDF document text
- http://toyotaprius-custom.com/js/upload/files/56495476386.pdfIn PDF document text
- https://www.euroservicemilano.it/wp-content/plugins/formcraft/file-upload/server/content/files/160aa8130b2808---rexikisu.pdfIn PDF document text
- https://promocionesnma.com/wp-content/plugins/super-forms/uploads/php/files/d3c954bd363b837c6d4dd0e3dd246006/48461434778.pdfIn PDF document text
- https://certifiedmoversinc.com/wp-content/plugins/super-forms/uploads/php/files/60fd7848fe76c1c4ebd041227b97569f/52406921581.pdfIn PDF document text
- https://alixdemassy.fr/userfiles/file/31940101698.pdfIn PDF document text
- http://cbelmira.com/wp-content/plugins/super-forms/uploads/php/files/r21ip3p1k66bp5j2jpie665ss2/38562757.pdfIn PDF document text
- https://rescue.bg/wp-content/plugins/formcraft/file-upload/server/content/files/160c423cc674f1---57484089407.pdfIn PDF document text
- https://szabobuszrendeles.hu/files/files/ruleba.pdfIn PDF document text
- https://thepetrichortouch.com/wp-content/plugins/super-forms/uploads/php/files/b11gs7hnkiugor105b7ni5acl1/bozexutobaromuti.pdfIn PDF document text
- https://www.lipfish.no/wp-content/plugins/formcraft/file-upload/server/content/files/160930c1eb3733---wefifiruvavegunutunu.pdfIn PDF document text
- https://washlounge.in/ckfinder/userfiles/files/61500087375.pdfIn PDF document text
- http://claudiodauelsberg.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a7583b6e620---depexe.pdfIn PDF document text
- https://www.ediliziaindustriale.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607bcb31e2c36---babir.pdfIn PDF document text
- https://tckontrola.hr/files/84820382521.pdfIn PDF document text
- https://tourgardan.com/basefile/tourgardancom/files/5403805372.pdfIn PDF document text
- https://www.inkfactory.pk/wp-content/plugins/formcraft/file-upload/server/content/files/160f8fa35d70a0---nutev.pdfIn PDF document text
- http://retco.ge/ckfinder/userfiles/files/nivonulewo.pdfIn PDF document text
- https://tirthmobile.com/wp-content/plugins/super-forms/uploads/php/files/knuj1mo8d0sm3t4ocn28t5a00t/1537869658.pdfIn PDF document text
- http://physiotherapy-warwickshire.com/user_file/file/favugeketanagatipet.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000df0b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDF0B	18292 bytes
SHA-256: `f493052cf96b4fcc9feaa21b49fe9b23fd07074115a0f9d8da829c75f7e15e52`
`font_01_sfnt_off00010ea3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10EA3	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off000126ba.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x126BA	10488 bytes
SHA-256: `1e75303b66ef40bec0650bf782535333cb63ce5de1cc28702b523027bab9a25e`

Open this report in the interactive analyzer, or submit your own file for analysis.