PDF malware analysis — malicious · dedc7c49899feba5

MALICIOUS

PDF

95.7 KB Created: 2021-08-05 23:14:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12

MD5: edfe666452c6b82ade10734975c1a0ee SHA-1: 5b022ac6151e0fe68eb7f46bb565c6b9342cc26b SHA-256: dedc7c49899feba5050d39729c4729640afc2fe8ed6cb8ae449b2893cb19d972

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample is a PDF document that contains numerous links to external websites, many of which appear to be compromised or disposable hosting. The ClamAV detection and the presence of link farms suggest a phishing or malware distribution campaign. The document body is heavily obfuscated and unreadable, but the heuristics indicate a malicious intent to redirect users to potentially harmful content.

Machine Learning

Nyx PDF Classifier suspicious score 0.4108

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nomylo.ru/uplcv?utm_term=the+drummer%27s+toolbox+pdf+free+download PDF link annotation
- http://raykingcarroll66.com/clients/2/29/292092747e06e0ab09130fa737b110c0/File/nibijutulidebekabokexusiv.pdfIn PDF document text
- http://www.jindatunnel.com/up_files/file/kekafatu.pdfIn PDF document text
- http://www.expo-hotel.com/english/wp-content/plugins/formcraft/file-upload/server/content/files/160a89bbbd6377---23665190670.pdfIn PDF document text
- http://svs-pm.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bf5db5c6579---13080085573.pdfIn PDF document text
- http://itkaufmann.com/images/fckimages/file/nudide.pdfIn PDF document text
- http://erfolgsapp.de/wp-content/plugins/formcraft/file-upload/server/content/files/160c61fb6883e1---23393685454.pdfIn PDF document text
- https://amalighting.com/wp-content/plugins/super-forms/uploads/php/files/29791c43f095cfe5a05a6d72da547397/pewavawadev.pdfIn PDF document text
- https://yidinfo.net/wp-content/plugins/super-forms/uploads/php/files/jk3k2on693ghk1und8v6uluocv/79448006873.pdfIn PDF document text
- http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/160e802041468c---72532994825.pdfIn PDF document text
- http://melissajacksonmd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160811e076dcc9---14232406709.pdfIn PDF document text
- https://edukiya.com/wp-content/plugins/super-forms/uploads/php/files/f6a6681f990238ffb3f27a64f5aa0256/xuzuru.pdfIn PDF document text
- http://greenreunion.org/clients/f/fd/fd69eab1634eeea6368acebbe5d5cb0d/File/57325198620.pdfIn PDF document text
- https://agrilaui.com/userfiles/file/zeperizizaforid.pdfIn PDF document text
- https://paklya.su/design/img/upload/file/23912455870.pdfIn PDF document text
- http://thm-holding.ru/wp-content/plugins/super-forms/uploads/php/files/ea11d6dea68bab8e89b19d4b7c9b2bc1/94830376423.pdfIn PDF document text
- https://dollarplus98.com/images/upload/files/gugovitazowugagokoniwel.pdfIn PDF document text
- https://brunoamaranti.it/wp-content/plugins/super-forms/uploads/php/files/2g7pih80ora9oo4ph00udu36p6/23140754217.pdfIn PDF document text
- https://www.northamericatalk.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098468b28333---razuwuv.pdfIn PDF document text
- https://neavocats.com/wp-content/plugins/super-forms/uploads/php/files/58c54f0d0d72c725ccf6b3c7fc429727/xifufipijenuzot.pdfIn PDF document text
- http://dataction.org/demo/dataction/media/vagapadafitapadezotemilog.pdfIn PDF document text
- https://www.lumisolar.pe/wp-content/plugins/formcraft/file-upload/server/content/files/1609eafd554217---2044290384.pdfIn PDF document text
- http://fecirturizm.com/resimler/files/buvigetonife.pdfIn PDF document text
- http://www.kreasoft.mx/wp-content/plugins/formcraft/file-upload/server/content/files/160b4dfd7a5a49---89399195136.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000128c3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x128C3	11096 bytes
SHA-256: `e4177379396c84163dc07fde7ff8f43f37e42e35afb6a347c3686782071baa11`
`font_01_sfnt_off0001425d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1425D	18148 bytes
SHA-256: `5bdc5c76254f38efeedbd503531ade9106cc8e9bfacccd02598b04896d1617f3`

Open this report in the interactive analyzer, or submit your own file for analysis.