PDF malware analysis — malicious · f1146cf65a0face3

MALICIOUS

PDF

70.7 KB Created: 2021-09-06 21:58:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24

MD5: 8f289c61385127dbb2826beef84864f7 SHA-1: 21ef85b5e56c0e56394d230555a6553870263a85 SHA-256: f1146cf65a0face350d6a3d91f0eb9626434f7d6017a3f3db45f23b829c9b7b5

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as a malicious PDF by ClamAV. Static analysis reveals it functions as a link farm, containing numerous URLs pointing to compromised WordPress sites. These sites likely host further malicious content or phishing pages, indicating a phishing or malware distribution campaign.

Machine Learning

Nyx PDF Classifier suspicious score 0.4326

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://bilagroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c19588dacb1---79895229643.pdf In PDF document text
- http://www.reroofingbrisbaneqld.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160c31b4728e08---logaxa.pdfIn PDF document text
- http://www.gobarging.com/uploads/textareas/file/23649991254.pdfIn PDF document text
- https://ventana-sur.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c3da6cddd04.pdfIn PDF document text
- http://www.mostenpo.jp/userfiles/files/minuwuxowasafodigugir.pdfIn PDF document text
- http://granitemountainranch.net/userimages/xinuzabenojizenagetivi.pdfIn PDF document text
- https://ebdaatcoop.com/userfiles/files/kuvomufafekapurigivi.pdfIn PDF document text
- http://cuanhuadanang.vn/uploads/image/files/rubiketiwixasinapupe.pdfIn PDF document text
- http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160853f62f1d0e---93430373673.pdfIn PDF document text
- http://protech.com.ng/wp-content/plugins/formcraft/file-upload/server/content/files/16119529eca742---dofamokijifeki.pdfIn PDF document text
- http://acetuitioncentre.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1608566007f48a---75639586314.pdfIn PDF document text
- http://allegroescrow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e26c7fe6860---66808453276.pdfIn PDF document text
- https://ncfouting.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d1f182f260---46583180033.pdfIn PDF document text
- http://naucseto.cz/storage/viluro.pdfIn PDF document text
- http://www.northeastmarquees.com/wp-content/plugins/super-forms/uploads/php/files/07054d2065aae3e492de7dc4ac70e44e/61130748242.pdfIn PDF document text
- https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/57rl5cdr5b6rupk4l9b8fc5kse/regesokokupakor.pdfIn PDF document text
- https://xn----7sbbjg7ctfs.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/9d83e05b518497ca814a1af80bf03603/pewonaguma.pdfIn PDF document text
- https://www.federatedlighting.com/wp-content/plugins/super-forms/uploads/php/files/49786d5333ee91313ee800e0850c3016/21535593395.pdfIn PDF document text
- https://michaels-limo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160be6a5e13762---jituxofido.pdfIn PDF document text
- http://ziepniekkalns.lv/wp-content/plugins/formcraft/file-upload/server/content/files/1606ea1b646488---54521792505.pdfIn PDF document text
- http://churchliferesources.org/wp-content/plugins/formcraft/file-upload/server/content/files/160b4a282f3a89---guwadan.pdfIn PDF document text
- https://nsck-cykelmotion.dk/userfiles/file/neguwumiwiragoxoxeroni.pdfIn PDF document text
- https://www.femregenx.co.za/wp-content/plugins/super-forms/uploads/php/files/n3qr03tkm28p0ug2v061pbc4o5/mosapela.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/YTWXjIUwRh0/uplcv?utm_term=noun+phrases+worksheets+for+grade+4PDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d47f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD47F	10972 bytes
SHA-256: `964453c304b6936cc0bf8ecf3678926f24b3ecae8e47db18c5689c5c0ae36a0c`
`font_01_sfnt_off0000edda.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEDDA	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.