PDF malware analysis — malicious · f03851f43f5fcaa0

MALICIOUS

PDF

75.7 KB Created: 2021-09-04 17:57:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-23

MD5: d290d9b7943e95f0a102d6af7de0ebb7 SHA-1: 302403705ecf1311371c60e59513c9f1251c3afd SHA-256: f03851f43f5fcaa0a2878680b294e89e462b0a7dcad15631b502efb22f966255

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links to compromised WordPress upload storage and disposable hosting, suggesting it functions as a link farm to distribute malicious content or phish users. The PDF structure and link farm characteristics point towards a phishing or malware distribution campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.9934

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://nitexprofi.cz/userfiles/file/laduwusezijowux.pdf In PDF document text
- http://www.gcsystem.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160984835713f0---sonowozezofisojuzuvikibif.pdfIn PDF document text
- https://www.thecandystoresudbury.com/wp-content/plugins/super-forms/uploads/php/files/f487v7opklvth35qldmt6pcquu/daloxukilumi.pdfIn PDF document text
- https://carthink.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a6b01a4c76f---pasovonitibefeniwamos.pdfIn PDF document text
- http://scard.vn/app/webroot/uploads/files/vodujutofapi.pdfIn PDF document text
- http://goldmustang.ru/files/files/wunabugagipogiw.pdfIn PDF document text
- http://andlupa.com/userfiles/file/zodimebugenokexosivonumaz.pdfIn PDF document text
- http://xingzhongjing.com/userfiles/file/20210821115454_767992628.pdfIn PDF document text
- https://vmwarts.com/ecovic/file/42676800292.pdfIn PDF document text
- http://herfon-machinery.com/images/ckfinder/files/20210829055950.pdfIn PDF document text
- https://combrooncom.com/contents//files/vogijo.pdfIn PDF document text
- https://isleo.com/i_photos/file/1479746893.pdfIn PDF document text
- http://b-solutions.net/userfiles/file/20441581407.pdfIn PDF document text
- https://athensviptour.com/wp-content/plugins/super-forms/uploads/php/files/6daef5fac7372c9ef74565c919372683/dijizuxexovezebitimu.pdfIn PDF document text
- http://halvani.com/wp-content/plugins/formcraft/file-upload/server/content/files/160953d68b59fd---vupadolulizarowun.pdfIn PDF document text
- http://in-dapt.com/wp-content/plugins/formcraft/file-upload/server/content/files/16102e9f6dd79f---xoxuzab.pdfIn PDF document text
- https://www.bouwenaaneensterkwerkgeversmerk.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c8e0eab7319---tukuvevegetubedawow.pdfIn PDF document text
- http://asalsold.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082ee42d83dd---40446303383.pdfIn PDF document text
- https://nceptionsolutions.com/wp-content/plugins/super-forms/uploads/php/files/5327eb115ec8f1a852b6a261ca6ec6a4/kufopisazilomibe.pdfIn PDF document text
- https://realwebguys.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612018b538f7e---perev.pdfIn PDF document text
- https://luminex.pl/upload/file/4748655140.pdfIn PDF document text
- http://xn----7sbab1bcaqplb0ccyi9d.xn--p1ai/files/file/51717608260.pdfIn PDF document text
- https://grandhotelbulgaria.com/userfiles/file/80611150229.pdfIn PDF document text
- http://www.ebsjosepirosamaria.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077262dbd147---xujutimuvazopaxekufoxem.pdfIn PDF document text
- http://viral-list-monster.com/ckfinder/userfiles/publics/files/kiwoxi.pdfIn PDF document text
- http://microsolder.hu/userfiles/files/nurufalu.pdfIn PDF document text
- http://aardbeienfeesten.nl/uploadimages/files/73226566210.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=flatten+pdf+in+acrobat+xi+standardPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c39c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC39C	10832 bytes
SHA-256: `923c92db237ad9fb37d0176468ba77c119e1fe39ca8d8cc8a0a2f9391a79916f`
`font_01_sfnt_off0000dc79.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDC79	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off0000f48b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF48B	17164 bytes
SHA-256: `d8001f6d6b380ac4903de8f3e9d971913866a8faa066460d05f6f8d7d73d3a5a`

Open this report in the interactive analyzer, or submit your own file for analysis.