PDF malware analysis — malicious · dafdcf672a782e70

MALICIOUS

PDF

86.9 KB Created: 2021-09-12 06:21:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16

MD5: d90865611eb97ac7da23aaae159335c8 SHA-1: 8ad9be3f99db690574e9e33c36cfb4a47df9cd96 SHA-256: dafdcf672a782e70cad953a82479749fd7fce7c3e6cd28092a10e5e8d37ccdcb

196 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by multiple heuristics as malicious, including a high-confidence ML classifier and ClamAV detection. The presence of a 'Password-protected archive handoff' heuristic suggests the document is designed to trick the user into providing a password for an encrypted archive, which likely contains a malicious payload. The numerous embedded URLs pointing to various domains, some of which are associated with compromised CMS uploads or disposable hosting, indicate a phishing or malware distribution attempt. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.9974

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://wastran.ru/uplcv?utm_term=vedere+italia+1+su+android PDF link annotation
- https://shibbirs.com/media/files/kigawojibirazabevuvexadez.pdfIn PDF document text
- https://thietbixaydungcantho.com/canthomobile2/public/images/sanpham/files/solagabuno.pdfIn PDF document text
- https://al-farh-iq.com/upload/userfiles/file/lawexebelatuzopow.pdfIn PDF document text
- https://mudrun.com/home/mud/public_html/ckfinder/userfiles/files/makibetuvujurizevebutave.pdfIn PDF document text
- http://www.fashiongale.ro/userfiles/files/27499473131.pdfIn PDF document text
- http://twsl.mingann.info/upload/ckfinder_temp/files/20210903205939.pdfIn PDF document text
- http://hanyangsteel.com/files/fckeditor/file/13181922566131abccdc611.pdfIn PDF document text
- http://www.uvhk.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613aed127c087---89750701674.pdfIn PDF document text
- https://chungcungoaigiao.vnpec.xyz/uploads/files/dunajufawojazobosobopike.pdfIn PDF document text
- https://www.baptistenhardenberg.nl/wp-content/plugins/formcraft/file-upload/server/content/files/161343a30e830f---fawutuxumizexifalale.pdfIn PDF document text
- https://noble-worldwide.com/wp-content/plugins/super-forms/uploads/php/files/c8150b002330cb10bf483b5a7c18dea5/88500114890.pdfIn PDF document text
- http://koreaseals.com/ckfinder/userfiles/files/zabugeme.pdfIn PDF document text
- http://hz-kontejnery.cz/ckfinder/userfiles/files/61337682823.pdfIn PDF document text
- http://dirpub.org/editor/ckfinder/userfiles/files/fejapevekuwewakixenex.pdfIn PDF document text
- http://cameronhaddock.com/wp-content/plugins/formcraft/file-upload/server/content/files/16138bb91cd32b---99219976119.pdfIn PDF document text
- https://salonrewards.ca/images/file/86422773260.pdfIn PDF document text
- http://casaatlantida.com/userfiles/file///2035874771.pdfIn PDF document text
- http://dwornawodzie.pl/userfiles/file/patifole.pdfIn PDF document text
- https://ballestermultiservicios.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613abaa6c03c0---radenoretolapuvi.pdfIn PDF document text
- https://www.nstoplana.rs/ckfinder/userfiles/files/gevogorifupolu.pdfIn PDF document text
- http://nsk-nalogov.net/upload/files/repelalokiruxutikatanij.pdfIn PDF document text
- http://01host.ru/userfiles/files/dabut.pdfIn PDF document text
- https://www.drmarlenebothma.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1612eb3f46a0fa---wanovatoresew.pdfIn PDF document text
- https://www.bevillelecomte.com/ckfinder/userfiles/files/deritisiju.pdfIn PDF document text
- http://generoussecurity.com/uploads/nezusapagiritogupuxojut.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ef9e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEF9E	10360 bytes
SHA-256: `a7d6bb0b582bf316a40a5d44cc8de30efe264b907d7874e5057b987c45cf9c8b`
`font_01_sfnt_off00010731.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10731	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00011f43.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11F43	17828 bytes
SHA-256: `e197ac163a024144d10a84290f90571dca8cd5187841d828b4954c3b2f7098cb`

Open this report in the interactive analyzer, or submit your own file for analysis.