PDF malware analysis — malicious · bf4b924f156f6a14

MALICIOUS

PDF

73.0 KB Created: 2021-07-19 02:56:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26

MD5: bb7dc219b80b1d100f0e00d451f91272 SHA-1: 8de172abdbf9a00b87b53aae1e8b723e94f72894 SHA-256: bf4b924f156f6a14ed8b65f760ceff69158ef35eef023933305db87b2eab8b1c

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links to external websites, many hosted on compromised CMS platforms or disposable domains, suggesting a link farm designed to redirect users to malicious content. The presence of 'utm_term' parameters in some URLs further supports a phishing or spamming campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.7669

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://seanmore.com/userData/board/file/43832208881.pdf In PDF document text
- https://orkhaconstruction.com/wp-content/plugins/super-forms/uploads/php/files/7kmdr8k40staacku1r9jv6ljo8/4993624863.pdfIn PDF document text
- http://ipvoicenj.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083fb851852e---megewijuwosi.pdfIn PDF document text
- http://maslatalaia.com/userfiles/file/lupalunupelebukejuforutu.pdfIn PDF document text
- https://www.cocochan.com.pk/wp-content/plugins/super-forms/uploads/php/files/57233a17132d245492fdbdadcaafdeb0/bimezelegidiw.pdfIn PDF document text
- https://www.a2zmedical.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160ba9f66ac9d2---nefukizidene.pdfIn PDF document text
- https://elsa-daulte.com/ckfinder/userfiles/files/24907812984.pdfIn PDF document text
- https://www.lavishlook.se/wp-content/plugins/super-forms/uploads/php/files/001bcb2bd7e1b4f67a43287c9078f8a8/zalozowotinakizosu.pdfIn PDF document text
- https://adm.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/d15c906f3145fdc13f6d5a3295214be7/3035434305.pdfIn PDF document text
- https://mimpiindah1.com/contents//files/2756079374.pdfIn PDF document text
- http://bafiti.com/sklep/userfiles/file/puneg.pdfIn PDF document text
- https://beachesbrewing.com/wp-content/plugins/super-forms/uploads/php/files/8b2106b22605f67a94e0282598030f42/58832048716.pdfIn PDF document text
- http://vitanova-cattery.com/upload/file/parelaj.pdfIn PDF document text
- http://intechsol.kz/wp-content/plugins/formcraft/file-upload/server/content/files/160b3da61bf5bc---tifol.pdfIn PDF document text
- http://aep-tc.com/cache/fck_files/file/lipiwipefu.pdfIn PDF document text
- http://ahdongjiu.com/upload_fck/file/2021-5-24/20210524030137997396.pdfIn PDF document text
- http://www.sunaryem.com.tr/wp-content/plugins/super-forms/uploads/php/files/nkko95mhmeaeb2cspmvbobo941/savabiko.pdfIn PDF document text
- http://terapeutickemasaze.eu/wp-content/plugins/formcraft/file-upload/server/content/files/16099fe602f468---mivegepufibupesaxurasito.pdfIn PDF document text
- https://weinquartier.at/wp-content/plugins/super-forms/uploads/php/files/6551654ae6b1f0b2e39cdd2aa5da0c5a/45198278809.pdfIn PDF document text
- https://shared401k.com/wp-content/plugins/super-forms/uploads/php/files/d1eb95e63d76483f8225e508a86134a6/lulesojelafize.pdfIn PDF document text
- http://arslanemlak.come/file/nupadu.pdfIn PDF document text
- http://patriabrno.cz/userfiles/files/93418162186.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/GLLx1DTH0VQ/uplcv?utm_term=social+studies+study+guide+8th+grade+answersPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e505.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE505	11232 bytes
SHA-256: `174a5ddcbd1866c1ced7eca30764844dfac1a3890ac5f773a18768a601ab918e`
`font_01_sfnt_off0000ff21.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFF21	16252 bytes
SHA-256: `c7e02cc57b68b5de9d9518dd8a07ad294908caa09f37a7aa3c8d0894c5b2152f`

Open this report in the interactive analyzer, or submit your own file for analysis.