PDF malware analysis — malicious · dfb4e07d556386cf

MALICIOUS

PDF

82.3 KB Created: 2021-09-03 10:28:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14

MD5: 9171213b893d47ca4eb90e2224e7d34c SHA-1: 5549cb992ee421612504255a06a55668b4f71978 SHA-256: dfb4e07d556386cfd2b26acb3636bede67a1a3286cdc0f3949dab1cad72ebec0

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a link farm pointing to multiple compromised WordPress sites, likely intended to redirect users to malicious content. The embedded URLs and the structure suggest a phishing campaign aiming to trick users into visiting these sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9974

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://synerhu.ru/uplcv?utm_term=inductance+physics+pdf PDF link annotation
- https://www.cibaospalaser.com/wp-content/plugins/super-forms/uploads/php/files/594gaf49jsppjklhir7eabe49f/tubanapapegowuxetuxazof.pdfIn PDF document text
- http://hakkabrothers.com/userfiles/file///javofaxixezeka.pdfIn PDF document text
- https://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607eb7acc481c---29976000548.pdfIn PDF document text
- https://www.hausbootgeiseltalsee.de/wp-content/plugins/super-forms/uploads/php/files/sdr66p1tfv2n15tl8roa7pod7a/99822545236.pdfIn PDF document text
- https://readxyz.com/wp-content/plugins/super-forms/uploads/php/files/83af0ecb624cbce88995d426e70a7894/bumosubavubuzoneje.pdfIn PDF document text
- http://batiment-tunisie.com/userfiles/file/ruvupewodutovezebesemim.pdfIn PDF document text
- https://graveyards-fuj.ae/userfiles/files/81299783274.pdfIn PDF document text
- http://metzpaintings.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a1d6ae1a98f---rusuroluzasemexakipes.pdfIn PDF document text
- https://roadtoring.com/wp-content/plugins/super-forms/uploads/php/files/e274efcdc723f0a267a2f1b8cf8a67bf/neradejakexaromifexo.pdfIn PDF document text
- https://www.18fire.com/wp-content/plugins/super-forms/uploads/php/files/c4bc744dc3e4f1dc2dbf5e2f0a157d1f/kewetevuwirigodob.pdfIn PDF document text
- http://kkc1.org/htdocs/cljr/data/files/13971823671.pdfIn PDF document text
- http://altinay-law.com/images/file/39098868692.pdfIn PDF document text
- http://climtech.com/files/files/zimogol.pdfIn PDF document text
- http://viaterrestre.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16121a7d215eb1---87316778883.pdfIn PDF document text
- https://www.cfo-search.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b969d6937c6---24478480457.pdfIn PDF document text
- https://nscs.org/wp-content/plugins/super-forms/uploads/php/files/175349e26ffebd85053eeff3df80d9b1/57025234955.pdfIn PDF document text
- http://cdseoulps.com/uploadfile/fckeditor/file/bokituzafomibukevadog.pdfIn PDF document text
- http://bitite.lv/media/txt/122/file/monoziwokupomamugu.pdfIn PDF document text
- https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/16083e89d0dd00---55090385228.pdfIn PDF document text
- http://beiwendq.com//data/attachment/file/puboniwerubajodapovovij.pdfIn PDF document text
- http://ecosdaliberdade.com/ckfinder/userfiles/files/xikujezubaresipe.pdfIn PDF document text
- http://apcmagon.com/userfiles/bogobene.pdfIn PDF document text
- http://snookerfootball.eu/wp-content/plugins/formcraft/file-upload/server/content/files/16113585051b76---35142860761.pdfIn PDF document text
- http://www.peopleoftheheath.com/wp-content/plugins/formcraft/file-upload/server/content/files/160fa7dee85f5e---xakubipopisire.pdfIn PDF document text
- http://brooklinehs1964.com/clients/6/6a/6a3559cec3eb17f551da2d864c8c85ab/File/41443896511.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000de5e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDE5E	17408 bytes
SHA-256: `46cff358777a507568b952abdb41d95fa2a61c56be658ea689fc53c5c6a5ce2d`
`font_01_sfnt_off00010b40.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10B40	10616 bytes
SHA-256: `59f3ceb0bac2f36187a2ffd732d098032c6a12ea4dbcc50914f2dfdb34d3fe69`
`font_02_sfnt_off0001237b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1237B	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.