PDF malware analysis — malicious · c3a4cd69bf28facb

MALICIOUS

PDF

93.4 KB Created: 2021-09-01 01:26:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11

MD5: a8a7dc075b9a0589fa04f47527875a75 SHA-1: da17edbdcf44165deb7baa096452156ac9b5723e SHA-256: c3a4cd69bf28facb0fd18cfdd26d1d73e2223fdaa85a95ae5964eb9a2443ab19

132 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample was detected as a phishing trojan by ClamAV. It contains embedded JavaScript and a large number of links, many pointing to compromised WordPress sites, suggesting it's designed to lure users to malicious content. The primary purpose appears to be redirecting users through a link farm to potentially download further malicious payloads or engage in phishing activities.

Machine Learning

Nyx PDF Classifier suspicious score 0.3397

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kfz-gutachter-oliver-schiller.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608098762aae3---zufedovukidurixuxizeg.pdf In PDF document text
- http://socialbomjesus.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/1608111ce09bec---64512335455.pdfIn PDF document text
- http://marketingnews.fr/images/file/5329444225.pdfIn PDF document text
- http://www.rannatennis.ee/data/upfiles/files/38168314056.pdfIn PDF document text
- https://victory-agency.com/wp-content/plugins/formcraft/file-upload/server/content/files/161255e9356fff---73524301524.pdfIn PDF document text
- http://arch-teh.com/pic/userfile/zugem.pdfIn PDF document text
- https://photographerin.agency/wp-content/plugins/super-forms/uploads/php/files/s9gnjksen16jf215mbc09car73/44993707387.pdfIn PDF document text
- https://saftanton.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1606cb4eca97b2---10924799578.pdfIn PDF document text
- http://gentlemensquartersbarbershop.com/wp-content/plugins/super-forms/uploads/php/files/80238c5f2f5c503efd22d1bbaf9fa44b/21495436627.pdfIn PDF document text
- http://canvangdientu.com/images/file/2672361051.pdfIn PDF document text
- https://militarynetwork.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160993657ace38---tonotulolopozabevabeb.pdfIn PDF document text
- http://bulgankhangai.mn/userfiles/files/vomef.pdfIn PDF document text
- https://advancedcheckcashadvance.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a68c37a5b35---87698178731.pdfIn PDF document text
- http://schokofontaenen.de/idata/60909681121.pdfIn PDF document text
- http://www.insurancedirectcanada.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609f51a2866bd---72487581119.pdfIn PDF document text
- http://adams-gold.ru/archive/image/file/5220057938.pdfIn PDF document text
- https://habibitours.net/ckfinder/userfiles/files/16376024788.pdfIn PDF document text
- http://caribsplash.org/wp-content/plugins/formcraft/file-upload/server/content/files/160782a2058f07---kanapogi.pdfIn PDF document text
- http://datcat.vn/2018/file/82721034488.pdfIn PDF document text
- http://indiebookoftheday.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d4e96adfc40---92804462641.pdfIn PDF document text
- http://daehwa.info/uploaded/file/sipatek.pdfIn PDF document text
- https://chatsystem.site/js/ckfinder/userfiles/files/gotizijo.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/Om9ozkHLxGw/uplcv?utm_term=define+path+difference+and+phase+differencePDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001178e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1178E	10552 bytes
SHA-256: `b29b05a5ef2dcf9a500982e38d20403a575e977bcb6443600fd55923b5f26ad3`
`font_01_sfnt_off00012f86.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12F86	21116 bytes
SHA-256: `3b476d402533a63ad91896a05fc9606cc29ff693ddce4e50c25ff601c0b1408d`

Open this report in the interactive analyzer, or submit your own file for analysis.