PDF malware analysis — malicious · cffe816e87c000e0

MALICIOUS

PDF

81.8 KB Created: 2021-08-18 05:32:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16

MD5: e540aec249dae29a3ebb0dd10b95b58d SHA-1: 98931705c11674a0f566ce0fdbe7e7bb0346ecea SHA-256: cffe816e87c000e034e4af8d535d5da7c5fae4936dbf008644c91ed7d7dee81c

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous links pointing to compromised WordPress sites and other disposable hosting, suggesting a link farm designed to redirect users. The PDF's structure and the presence of multiple external URIs strongly suggest it's part of a phishing or malware distribution campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.9911

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://voyagerf.ru/wp-content/plugins/super-forms/uploads/php/files/9925020b6591fb609b4d9fc2829ad423/32683867609.pdf In PDF document text
- http://paolacaone.eu/userfiles/files/xujanudeza.pdfIn PDF document text
- https://pluckywize.com/wp-content/plugins/formcraft/file-upload/server/content/files/160777f9908f59---6242234085.pdfIn PDF document text
- https://hazeloyun.com/calisma2/files/uploads/47343993555.pdfIn PDF document text
- http://camel-republic.com/media/userfiles/files/96961309751.pdfIn PDF document text
- https://www.enviedecrire.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e2944187b2---5352956413.pdfIn PDF document text
- https://studiogreenwich.ru/wp-content/plugins/super-forms/uploads/php/files/13a4f5741e11717aa79f4310c12f1c01/7145364485.pdfIn PDF document text
- http://www.timtransportes.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/16087eb87d958b---52375381875.pdfIn PDF document text
- http://fitsiluet.cz/data/file/pasaxedalavefe.pdfIn PDF document text
- http://drvision.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a6719134cb1---relope.pdfIn PDF document text
- http://hdurmuslar.com/images_upload/files/lesatuz.pdfIn PDF document text
- https://www.domaine-de-la-ferme.fr/ckfinder/userfiles/files/906399319.pdfIn PDF document text
- http://www.stratcareerservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160beed7b24176---38287726944.pdfIn PDF document text
- http://israel-aliya.com/wp-content/plugins/super-forms/uploads/php/files/91809f01a5704033ab59c6c32e651c1f/52870004285.pdfIn PDF document text
- http://vitaminyplus.eu/files/file/58829324841.pdfIn PDF document text
- http://irmascaritasdejesus.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160944ee93ed6e---sowim.pdfIn PDF document text
- https://www.chortho.co.uk/wp-content/plugins/super-forms/uploads/php/files/tn16r3719s0v5kga5h7h3307qi/5544036305.pdfIn PDF document text
- https://refour.eu/wp-content/plugins/super-forms/uploads/php/files/aac97823dabda248f657b794a4d1529d/59527478060.pdfIn PDF document text
- http://gsoam.ge/wp-content/plugins/formcraft/file-upload/server/content/files/160c8a78d676e8---wasupixovorawuzidikoveje.pdfIn PDF document text
- http://regimhotelierbucuresti.com/images/userfiles/86537167636.pdfIn PDF document text
- https://aarhuskortet.dk/images/file/9241655083.pdfIn PDF document text
- https://k-kompany.ru/wp-content/plugins/super-forms/uploads/php/files/e3a2697915579ac60e8e8669ce65846f/97847862529.pdfIn PDF document text
- http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a4da1f5ba9e---sinoxivaja.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b6697c939bb---xufupenijena.pdfIn PDF document text
- http://susutour.com/userfile/file/wamibijosukevupegemosave.pdfIn PDF document text
- http://crystal-lamp.ru/uploads/files/65733110800.pdfIn PDF document text
- http://slbreakingnews.com/ckfinder/userfiles/files/85462951234.pdfIn PDF document text
- http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160a16f7ef1e1b---70485843186.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/BvfzZFkJO3s/uplcv?utm_term=what+are+normal+hcg+levels+at+2+weeks+pregnantPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dd18.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDD18	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000f52f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF52F	11088 bytes
SHA-256: `6f85f76dd72772b8d6779bd2590690f30cffa68025e46ce16c3188acf48f7ce1`
`font_02_sfnt_off00010f06.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10F06	16100 bytes
SHA-256: `a70ffe0ba2e352208cccc43b6aec72a3708792e6e9f990f0f0ef149daf0eb813`

Open this report in the interactive analyzer, or submit your own file for analysis.