PDF malware analysis — malicious · e11924bad3fc37f2

MALICIOUS

PDF

89.0 KB Created: 2021-07-24 19:10:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-13

MD5: 95d52bae27a74efce272d5f570d937f9 SHA-1: 88725862496d2a048e13d7e73d9b15ead0c33a75 SHA-256: e11924bad3fc37f292628dcfd065f579de7aaa02e70e4455c15f296e4b7d9ea8

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. Heuristics identified it as a link farm pointing to compromised WordPress upload storage, suggesting it's used to host or redirect to malicious content. The presence of multiple unknown URLs further supports its role in a phishing or malware distribution campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.9973

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bbf186bb983---93372307790.pdf In PDF document text
- http://dossalas.com/wp-content/plugins/super-forms/uploads/php/files/7cbdac6cf0cab0b85c3464ec6a49c1c2/wiratisitulogalu.pdfIn PDF document text
- http://vilaportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/160fb5ace9318d---kixevikonujebuwug.pdfIn PDF document text
- http://firegallery.ru/img/upload/484824617.pdfIn PDF document text
- http://retco.ge/ckfinder/userfiles/files/73128269213.pdfIn PDF document text
- https://landbondcorten.com/attachment/file/aef0efd98414be320cff5f49199f21ff.pdfIn PDF document text
- https://www.americanapi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f9eb7d6a1c5---26719284539.pdfIn PDF document text
- https://araprinter.com/ckfinder/userfiles/files/sejis.pdfIn PDF document text
- https://nenanhduong.vn/Upload/files/82057612424.pdfIn PDF document text
- http://mesterek.net/tmp/lugom.pdfIn PDF document text
- https://www.accidentinjurylascruces.com/wp-content/plugins/super-forms/uploads/php/files/28nm7ofhnvd6ag4aksin33h3ql/mojov.pdfIn PDF document text
- http://pavcargo.ru/wp-content/plugins/super-forms/uploads/php/files/4de04abd32d5639e5947092de67183af/75948460743.pdfIn PDF document text
- http://www.vivelamusica.es/wp-content/plugins/formcraft/file-upload/server/content/files/160f7644d4972c---54672178748.pdfIn PDF document text
- https://pabausa.org/wp-content/plugins/formcraft/file-upload/server/content/files/160756b1707910---nuvanir.pdfIn PDF document text
- https://www.lightingsolutionsal.com/wp-content/plugins/super-forms/uploads/php/files/a575630ba586ada3f7f43042bb1ae4d4/rizakulekevip.pdfIn PDF document text
- http://nd-58.ru/wp-content/plugins/super-forms/uploads/php/files/b8e7f2280d0965e64191a2d3af8312b7/wexujojupezowetedipof.pdfIn PDF document text
- http://waltwhitman1964grads.com/clients/6/6c/6c9ae932573016e5ff31759a10dce4b4/File/xewiwamotozidozafuxemu.pdfIn PDF document text
- http://oreade-breche.fr/userfiles/file/jakonedanukuguxadobemulu.pdfIn PDF document text
- https://actorconseil.com/files/file/dukupiwebirawivezupoture.pdfIn PDF document text
- https://hoffmanowska.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160c4ccc6e19f1---46743713870.pdfIn PDF document text
- https://amirep.com/wp-content/plugins/super-forms/uploads/php/files/77f6aff9c17843b843ef783a81fc54c6/32714413358.pdfIn PDF document text
- https://istocdukkan.com/userfiles/files/32459401472.pdfIn PDF document text
- https://wagaskar.com/media/79321820046.pdfIn PDF document text
- http://myucmas.com/userfiles/file/26083747282.pdfIn PDF document text
- https://vakukh.ru/wp-content/plugins/super-forms/uploads/php/files/3d1ad67ec1db7226d34e7485d16ba68f/fabubedewulemol.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=descargar+recuva+professional+full+2018+gratisPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f42a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF42A	18176 bytes
SHA-256: `ad7bf440a35aada6968829b2a694c5b03263985fa162b1c3080383d4041390d6`
`font_01_sfnt_off000122db.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x122DB	11324 bytes
SHA-256: `30adaafe9421ae594f0570d006061f2cde4a6462583ea1821c4080e67279f0cf`
`font_02_sfnt_off00013dc1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13DC1	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.