PDF malware analysis — malicious · b548615e88763b08

MALICIOUS

PDF

74.0 KB Created: 2021-09-06 15:07:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12

MD5: 83738e4a2b28e501c3b506bfba818213 SHA-1: e522d7c72122e0d0b1f325aa8f70b9fc5f986ac6 SHA-256: b548615e88763b08d4dc80c56e404dd869a30797aececa354bb9e1c0102a05b8

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document was flagged by ClamAV as Pdf.Phishing.Trojan and ML classifiers indicate a high probability of maliciousness. Heuristics identified numerous external URIs and a link farm structure, suggesting the document's primary purpose is to redirect users to potentially malicious websites. The presence of embedded URLs and the nature of the link farm indicate a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9907

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://synerhu.ru/uplcv?utm_term=coffing+lsb-b+manual PDF link annotation
- http://www.nanodrywash.com/wp-content/plugins/formcraft/file-upload/server/content/files/16094a6ed78185---83450131175.pdfIn PDF document text
- http://brunsfamilyreunion.org/clients/e/e7/e70b0594429ddd28dfd4dd2f61c76e80/File/guridaw.pdfIn PDF document text
- https://webhostmurah.com/wp-content/plugins/formcraft/file-upload/server/content/files/160abd7ff85bd6---21129266885.pdfIn PDF document text
- http://mopron.ru/upload/files/27933881566.pdfIn PDF document text
- https://bestcoloringpages.com/userfiles/file/90108123815.pdfIn PDF document text
- http://www.rolstoellift.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a012578490d---tepesaj.pdfIn PDF document text
- https://tecsal.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16071f8f69b209---kovogewesu.pdfIn PDF document text
- http://954move.com/clients/4890/File/48065611574.pdfIn PDF document text
- https://www.alphaveneers.com/wp-content/plugins/super-forms/uploads/php/files/0e2e0d407ba9995cb044cd5802e69bbf/24498737175.pdfIn PDF document text
- https://kmkmekanik.com/upload/ckfinder/files/mogatepemuwivubekilup.pdfIn PDF document text
- http://pinxedien.net/upload/files/magukitiberur.pdfIn PDF document text
- https://www.sudburyhighspeedinternet.ca/wp-content/plugins/super-forms/uploads/php/files/c93623a72a9739e500cd43aff2b5f310/56267276417.pdfIn PDF document text
- https://prawobrzeze.info/userfiles/file/94809282988.pdfIn PDF document text
- https://www.audifonosdoshoydos.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a421897a2c2---23483702277.pdfIn PDF document text
- http://phuvuongcorp.com/luutru/files/92079925248.pdfIn PDF document text
- http://mobilesamara.com/img/files/file/gofokakemegotajozoladip.pdfIn PDF document text
- https://opuntia.eu/wp-content/plugins/super-forms/uploads/php/files/4220fbabea18c5ca068ee708d11abdbc/fasifedesamorip.pdfIn PDF document text
- https://visaonline-vn.com/wp-content/plugins/super-forms/uploads/php/files/gus0gb17nsg03knkh8ej9uv43a/19574766971.pdfIn PDF document text
- http://ipost.mn/ckfinder/userfiles/files/31273944547.pdfIn PDF document text
- http://le-lemniscus-incandescent.fr/ckeditor/upload/files/labonoxonazobujox.pdfIn PDF document text
- https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160fdbcf9a2dd1---16908144944.pdfIn PDF document text
- https://amalighting.com/wp-content/plugins/super-forms/uploads/php/files/b081c0e5351e1bcec6f48d057820b14d/44230132036.pdfIn PDF document text
- http://bapassamarinda.id/assets/ckfinder/core/connector/php/uploads/files/xikoxitewugofodijekaje.pdfIn PDF document text
- http://www.auditsi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16121e77f542ff---nibugusisokepevuni.pdfIn PDF document text
- https://www.diktu.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c10465254cb---vozovotekesubejuwuwiko.pdfIn PDF document text
- https://loskutova.site/wp-content/plugins/super-forms/uploads/php/files/213eb4e8ca788700cac1e3744edba939/53464924617.pdfIn PDF document text
- http://fotografoenricogiampieri.it/userfiles/files/6293164886.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000bd5d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBD5D	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000d574.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD574	10532 bytes
SHA-256: `736a38718faa16f504a1a654fce93f1eb8e299f794e2dd953eaf9b7b274d50ae`
`font_02_sfnt_off0000ed6e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xED6E	16700 bytes
SHA-256: `608eeb2a90fa47bc5055a44e2248c2384842fc4108d33fd3372b82377740623b`

Open this report in the interactive analyzer, or submit your own file for analysis.