PDF malware analysis — malicious · bba579769342b989

MALICIOUS

PDF

88.8 KB Created: 2021-08-12 07:07:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14

MD5: 3d6428964c087c5695528e0202f2db1a SHA-1: 8d682a4d1b5c38351a7990e07621116a94d2a5a7 SHA-256: bba579769342b98906762605d8144d1b9db8fa9bddf74ebed7b430241aa65264

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous links pointing to compromised websites, suggesting it functions as a lure to redirect users to potentially harmful content. The presence of multiple distinct hosts and link farms indicates a broad distribution effort, likely for phishing or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9912

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pixomot.ru/uplcv?utm_term=what+are+some+examples+of+endothermic+reactions PDF link annotation
- http://ecbpolska.pl/wp-content/plugins/super-forms/uploads/php/files/49c8dcd7b95100412352e4e05a6d8fb2/73779719717.pdfIn PDF document text
- http://wongkungfu.ca/clients/f/f5/f5c316b966f29b3192b3e9e3c5714b3c/File/maruw.pdfIn PDF document text
- https://bokseinstituttet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160adfe880738d---4048094796.pdfIn PDF document text
- https://beachesbrewing.com/wp-content/plugins/super-forms/uploads/php/files/1bbba35e12f0e995362140613d4c15e8/57385502912.pdfIn PDF document text
- http://banquat.com/userfiles/files/95781770053.pdfIn PDF document text
- http://bobas24.pl/Upload/file/vilifizajuwejimoluram.pdfIn PDF document text
- https://www.grecosalesinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a90e6718bb---87575568372.pdfIn PDF document text
- https://eyetracking.pl/userfiles/file/97666199784.pdfIn PDF document text
- http://melissajacksonmd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bc9ffec8990---bitomebanuxivojisezere.pdfIn PDF document text
- https://ohligschlaeger-berger.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606d9d6f5d1dd---bovetarer.pdfIn PDF document text
- https://syntellect.ru/Repository/file/70969100257.pdfIn PDF document text
- http://fly.no1-yes.com/userfiles/file/tujogakuwirunuvobivarizum.pdfIn PDF document text
- https://tehnol.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160c8872c5dcf8---68851298825.pdfIn PDF document text
- http://charivne.info/images/file/16469306824.pdfIn PDF document text
- https://kuepancong.com/contents//files/88835198430.pdfIn PDF document text
- https://freedomtampons.com/wp-content/plugins/super-forms/uploads/php/files/49017c7ca6ae6b56b19fde80324b3928/kiwewabafe.pdfIn PDF document text
- https://selectwifi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160989fec439ba---pelotu.pdfIn PDF document text
- http://nissanotogovap.vn/uploads/images/files/vixururi.pdfIn PDF document text
- https://brokenspoke.com/wp-content/plugins/super-forms/uploads/php/files/23b25f8871382c1ce21e726b2efd8aa7/nawojiwujovadexerojudi.pdfIn PDF document text
- http://sb-78.ru/files/file/96096238921.pdfIn PDF document text
- http://www.investing-in-women.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b3fdf05f358---xatur.pdfIn PDF document text
- http://stavebnevyrobky.sk/www/upload/files/fesemazokesoxevusilatopun.pdfIn PDF document text
- https://mamproducciones.es/wp-content/plugins/formcraft/file-upload/server/content/files/1607894c5ab8e4---12809939902.pdfIn PDF document text
- http://kaymccarthy.com/immagini/file/xufojafusoriz.pdfIn PDF document text
- https://zzarosiscarampola.it/file/mojitemofexekajarimabuw.pdfIn PDF document text
- https://pankalconstructora.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b3ccee58383---12645958616.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eff8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEFF8	19420 bytes
SHA-256: `9ac57bd62f631fb0c50676982880ade963ef091d42957345b7eb69f709d98c23`
`font_01_sfnt_off0001239c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1239C	10980 bytes
SHA-256: `61930f93443e730b71e04100cd4da848fc7cc50e2e06b04ee77fe6618505e59a`
`font_02_sfnt_off00013cf2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13CF2	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.