PDF malware analysis — malicious · b7ae7898c110af26

MALICIOUS

PDF

86.0 KB Created: 2021-07-18 13:10:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16

MD5: 1903f6a85155fb4cff8c37d15a902881 SHA-1: 28dce6d0377f16d71c37f5443024f4b271889770 SHA-256: b7ae7898c110af26d7afbfeaf40cdb438cc665fa48b38782f32a389476e7fb04

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a link farm pointing to multiple compromised WordPress sites and disposable hosting, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were directly extracted, the PDF structure and embedded URLs are indicative of a malicious document, likely a spearphishing attachment.

Machine Learning

Nyx PDF Classifier malicious score 0.9835

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.tif.cn/wp-content/plugins/super-forms/uploads/php/files/hm9jiqh1ml698p3psgqnksr29g/futawaja.pdf In PDF document text
- http://tradeweb.es/userfiles/file/laniluxejip.pdfIn PDF document text
- https://rjiminfra.com/wp-content/plugins/super-forms/uploads/php/files/5ac7f9de101b005f63b9946fb1ad1572/40667469507.pdfIn PDF document text
- http://kimkhimientrung.com/uploads/image/files/tozalivu.pdfIn PDF document text
- https://law.myvzl.com/wp-content/plugins/super-forms/uploads/php/files/ik7r7venmfg2q1rr4bhpph9lmm/55836443378.pdfIn PDF document text
- http://swissies.lt/ckfinder/userfiles/files/30734664424.pdfIn PDF document text
- http://kfnmsz.com/upfolder/e/files/20210622192725.pdfIn PDF document text
- https://allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/1e64352cae3bb913d92c8816283bd50f/63538753051.pdfIn PDF document text
- http://baltic-rt.ru/ckfinder/userfiles/files/51144186245.pdfIn PDF document text
- http://bagpack.com.np/wp-content/plugins/formcraft/file-upload/server/content/files/160c8a1aae8d9c---7489424597.pdfIn PDF document text
- https://trichynext.com/wp-content/plugins/super-forms/uploads/php/files/3aaf4090eefe5344978ffb99ef757be2/vikimuzivoxizage.pdfIn PDF document text
- http://www.adarshvidhyasankul.org/userfilesfile/bofanigovo.pdfIn PDF document text
- http://webscape.co.bw/wp-content/plugins/formcraft/file-upload/server/content/files/160715341a132f---76229809659.pdfIn PDF document text
- http://gulfcoolcontracting.com/uploads/userfiles/file/file/23820487120.pdfIn PDF document text
- https://leicht-spb.ru/wp-content/plugins/super-forms/uploads/php/files/4b070e3cde644f5de722e544ffae05cd/74645457393.pdfIn PDF document text
- https://husvagnsexpo.se/wp-content/plugins/formcraft/file-upload/server/content/files/1606cb498b57e5---48761571211.pdfIn PDF document text
- http://pericosrentcar.com.mx/wp-content/plugins/formcraft/file-upload/server/content/files/1607cbdd37dfd7---4971915963.pdfIn PDF document text
- https://ohligschlaeger-berger.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607c981eed34d---zewixalajusu.pdfIn PDF document text
- http://csc-021.com/userfiles/file/20210621011643_ggjz9o.pdfIn PDF document text
- http://gphs84.com/clients/866382/File/31583608710.pdfIn PDF document text
- https://www.lightingdynamics.com/wp-content/plugins/super-forms/uploads/php/files/95e8e692ef1b2382586f43727c8b293f/bivoxug.pdfIn PDF document text
- http://commune-bourre.com/userfiles/file/2910686732.pdfIn PDF document text
- http://reicar.dk/userfiles/file/vobep.pdfIn PDF document text
- http://drinkandshrink.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160a28a664770b---zipam.pdfIn PDF document text
- https://www.idromeccanicasrl.com/idromeccanicasrl.com/wp-content/plugins/super-forms/uploads/php/files/5ffc35bb03ea7da46b6212ca3ee0d503/konatezomexuxolo.pdfIn PDF document text
- http://www.accl-calibration.com/login/ckfinder/userfiles/files/26167651906.pdfIn PDF document text
- https://gmonlinestore.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072803a7e231---88724568191.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/cv9VXjIrmdE/uplcv?utm_term=how+to+find+archived+orders+on+amazonPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eceb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xECEB	17044 bytes
SHA-256: `0a1005bc0c93ab90d3216e9c11a1a64966c0184f1879837a757754b934738a3d`
`font_01_sfnt_off0001195b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1195B	10896 bytes
SHA-256: `6d9640929630e751171420d4358235878b4066a7d3bc7ae751076b1c4cb10404`
`font_02_sfnt_off00013275.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13275	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.