PDF malware analysis — malicious · b9b94436de92a959

MALICIOUS

PDF

90.1 KB Created: 2021-09-19 01:49:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12

MD5: cc3055ad894aad63b5b6d8b370b7f270 SHA-1: 7679aa21c26a2d5273ed55388c1cd2b400edcf52 SHA-256: b9b94436de92a95968b8a29bf20e010866883c73f1884a0e06ad5e550bcc0e13

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It functions as a link farm, directing users to multiple compromised or disposable hosting sites, one of which is hosted on a compromised WordPress upload storage. The embedded URLs suggest a phishing or malware distribution lure, potentially disguised as a software download.

Machine Learning

Nyx PDF Classifier malicious score 0.9333

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://coretry.ru/uplcv?utm_term=ms+office+onenote+2007+free+download PDF link annotation
- http://sicilyontable.it/userfiles/files/40039722866.pdfIn PDF document text
- https://loyallcanada.net/editor_files/file/15166622600.pdfIn PDF document text
- http://www.scmphotography.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1613fd107c866e---zunugogajovegikodamidijen.pdfIn PDF document text
- http://esistore.de/userfiles/file/20479294218.pdfIn PDF document text
- http://levne-pohary.cz/UserFiles/File/2053986815.pdfIn PDF document text
- http://jocoseatee.com/userfiles/files/97379903894.pdfIn PDF document text
- http://jnmindia.com/outscapes/admin/ckeditor/uploads/ck/files/xifanasexiberuwumutu.pdfIn PDF document text
- http://aldobini.it/userfiles/files/bokuwirujedol.pdfIn PDF document text
- https://totspotdaynursery.co.uk/ckfinder/userfiles/files/notimemidejofexasafep.pdfIn PDF document text
- http://7166867.ru/ckfinder/userfiles/files/pizixile.pdfIn PDF document text
- http://www.ctmmaximoravenna.com/ckfinder/userfiles/files/lejofure.pdfIn PDF document text
- https://office-agglo-larochelle.fr/userfiles/file/zisipuvajetabupilovoj.pdfIn PDF document text
- http://rusiuojigalvoji.lt/wp-content/plugins/formcraft/file-upload/server/content/files/1613c81d96229b---letoremumi.pdfIn PDF document text
- https://madspot.dk/ckfinder/userfiles/files/lakebadanuselesixifota.pdfIn PDF document text
- http://investinwielkopolska.pl/application/lib/ckfinder/userfiles/files/35239259809.pdfIn PDF document text
- https://avflash.nl/upload/files/janutubureba.pdfIn PDF document text
- https://samsungklima.net/upload/ckfinder/files/sizebusiboxup.pdfIn PDF document text
- http://thietkewebbacninh.com/webroot/img/files/84837150661.pdfIn PDF document text
- http://geriatriccarenewjersey.com/userfiles/files/lenaneri.pdfIn PDF document text
- https://hohsingfiber.com/ufiles/files/jomefazerivaduzubanuf.pdfIn PDF document text
- http://comlark.ru/userfiles/files/49584420658.pdfIn PDF document text
- https://vettercycles.ch/userfiles/files/51450722162.pdfIn PDF document text
- http://gostium.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613f53dece295---mewunaj.pdfIn PDF document text
- https://sindhuinvestment.com/ckfinder/userfiles/files/47651340584.pdfIn PDF document text
- http://faizleathergloves.com/userfiles/files/linik.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off0001192f.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1192F	19056 bytes
SHA-256: `7d4a738bc76bab15ec3878348b657ce8a576442ed9054d5ee85eb3ac372a5d38`
`font_00_sfnt_off0000ec21.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEC21	17332 bytes
SHA-256: `872fb3e691eee8fa4af754f3ab4aed019d627844b6e885036952838fd6a388bf`
`font_02_sfnt_off0001382a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1382A	10840 bytes
SHA-256: `94fde0931624676ba51f3a4d0b64527fa74e2efe746eb60d4f85d5a08da6c34a`
`font_03_sfnt_off00015184.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15184	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.