PDF malware analysis — malicious · f2c4bfce96d5aaee

MALICIOUS

PDF

82.4 KB Created: 2021-08-17 16:26:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12

MD5: a2a315b71149388f258b9d1d8b17c3e7 SHA-1: 09897622b0f05025fcbcec6d6d6c643729062610 SHA-256: f2c4bfce96d5aaee84292c168cf959b9a86a7c856fe3abaac63ce5f3f52fa252

196 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan payload. It contains numerous embedded URLs pointing to compromised websites and disposable hosting, likely serving as a link farm to distribute further malicious content. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document may instruct users to open a password-protected archive, a common tactic to bypass gateway security.

Machine Learning

Nyx PDF Classifier malicious score 0.9690

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://huntic.ru/uplcv?utm_term=descargar+civil+cad+3d+gratis PDF link annotation
- http://harposwebdesign.nl/app/webroot/files/userfiles/files/bodinegaratagasid.pdfIn PDF document text
- http://rzn-house.ru/upload/file/sisaxolixazosezogikar.pdfIn PDF document text
- http://www.immiflex.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080a42184538---62274418452.pdfIn PDF document text
- https://tuabogadoangel.com/wp-content/plugins/super-forms/uploads/php/files/50c666543e4db10b7787ce62814852d1/52211475427.pdfIn PDF document text
- http://www.olympussverige.se/wp-content/plugins/super-forms/uploads/php/files/a512lo46ari00ucdf290p685k3/fixuguzutokafa.pdfIn PDF document text
- https://xn--i1aam8cb.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/eb8c2fca407a66dd67abb7bee008fed2/91554259977.pdfIn PDF document text
- https://michaels-limo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a3d109245c0---namidatopuwupoj.pdfIn PDF document text
- https://digireg.se/upload/83289914648.pdfIn PDF document text
- https://www.ikedatosou.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e162286d89a---33991376140.pdfIn PDF document text
- https://digireg.ch/upload/40555868003.pdfIn PDF document text
- https://newat.ru/wp-content/plugins/super-forms/uploads/php/files/96802d02aff9dffcb688ae5631d32020/werajiwabimexonitetis.pdfIn PDF document text
- http://aromaonly1.com/yamituki-n/uploads/files/55480825649.pdfIn PDF document text
- http://blackhorsesc.pl/userfiles/file/70626375934.pdfIn PDF document text
- https://sketchup360.vn/wp-content/plugins/super-forms/uploads/php/files/hef56l41sq9h2gbl15s9n2krti/61345186074.pdfIn PDF document text
- https://schreinerheusi.de/wp-content/plugins/formcraft/file-upload/server/content/files/160af6eaae5be8---tofebokud.pdfIn PDF document text
- http://opalbiosciences.com/wp-content/plugins/formcraft/file-upload/server/content/files/161043a5a9b30d---72113482228.pdfIn PDF document text
- http://ajtoablakcentrum.com/_user/file/81701641543.pdfIn PDF document text
- http://plncse.hu/php_data/file/xixikewax.pdfIn PDF document text
- http://dansungsala.com/uploads/files/36362514051.pdfIn PDF document text
- http://www.propper-droppers.nl/files/file/sizadegure.pdfIn PDF document text
- http://abaj.cz/UserFiles/File/nutajitulege.pdfIn PDF document text
- http://www.allatpatikapecs.hu/images/file/pikolulirimidodetanosepu.pdfIn PDF document text
- http://hkt-optics.com/hkt/images/userfiles/file/xijunu.pdfIn PDF document text
- http://kondicionery-ivanteevka.ru/upload_picture/file/4916523715.pdfIn PDF document text
- https://relaxationplusmn.com/wp-content/plugins/super-forms/uploads/php/files/a71bb9a91a1192612089e18867dee85c/xavud.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e1ed.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE1ED	18180 bytes
SHA-256: `8b3dce41504c03fa7c31793f8dffe9a34676bd6b90bb7af9c2f7f9f3a5791970`
`font_01_sfnt_off000110e3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x110E3	10560 bytes
SHA-256: `65e72ad45e61e7ba939edf7c1065defa4a75f5be0a5b6153b5544e69bc7a5db6`
`font_02_sfnt_off000128fd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x128FD	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.