PDF malware analysis — malicious · fffe6be4ec004d92

MALICIOUS

PDF

94.1 KB Created: 2021-07-30 21:01:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-24

MD5: b88fb5f0d1b610bd73cdb1b31b0b6928 SHA-1: c85cc37bf2a6c367475db016572c2b7fadcceb43 SHA-256: fffe6be4ec004d92c67bd7f1687e6bed6a140ea4bbb0748dcd0ea1e28480d916

212 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and numerous links to external URLs, many hosted on compromised WordPress sites. The heuristic 'SE_INVOICE_LURE' indicates the document's content is designed to trick the user into downloading a malicious file, likely a second-stage payload. The presence of embedded JavaScript suggests an attempt to execute code or redirect the user to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 9

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK

PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://chcial.ru/uplcv?utm_term=jazz+cash+app+apk+old+version PDF link annotation
- https://www.lipfish.no/wp-content/plugins/formcraft/file-upload/server/content/files/160b121603a20d---82972902168.pdfIn PDF document text
- http://www.zav-mito.si/wp-content/plugins/formcraft/file-upload/server/content/files/160ec459223532---tesabaluruvewebuzafevuvil.pdfIn PDF document text
- http://bannermaul.com/userData/board/file/likitone.pdfIn PDF document text
- http://cnc-soustruzeni.cz/files/file/duxav.pdfIn PDF document text
- https://bangprice.com/bangprice.com/beta/cms_image/file/vogomosigesoxijinisosalix.pdfIn PDF document text
- http://stepsforstarlight.org/clients/c/c6/c668404594a1c08d975ab50c7bec58f6/File/79194051576.pdfIn PDF document text
- http://www.ellisrasbetonwerke.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1608e55783d2b9---99273258799.pdfIn PDF document text
- http://erfolgsapp.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608c512f43242---74545795705.pdfIn PDF document text
- https://senzedigicraft.com/wp-content/plugins/super-forms/uploads/php/files/0e49da5a6df1886a439204fce1660ace/29876949978.pdfIn PDF document text
- http://cambodiadriverservice.com/userfiles/file/webimofipimolos.pdfIn PDF document text
- http://altadirezione-consulting.it/userfiles/files/dufodabawali.pdfIn PDF document text
- https://buddingheights.org/wp-content/plugins/formcraft/file-upload/server/content/files/16078823311b43---47646780956.pdfIn PDF document text
- http://ventiliatoriai.lt/js/ckfinder/userfiles/files/8832772438.pdfIn PDF document text
- https://www.siemers-deutschmann.de/wp-content/plugins/super-forms/uploads/php/files/faqjqrtl5kst5a1vgg4iplmuph/masawigapalam.pdfIn PDF document text
- https://g-ortho.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1606fe9b1609f9---nerojuzivezasadisuviloju.pdfIn PDF document text
- https://purpleleafestatebuyers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a32a2e3dd2c---jasefedigarosoxegojobobed.pdfIn PDF document text
- https://tuabogadoangel.com/wp-content/plugins/super-forms/uploads/php/files/3dc1f66071d740d0419304dcb193d21a/lufopoxerojinovadogalo.pdfIn PDF document text
- http://antwerp-rentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ef0618be4f---36281349366.pdfIn PDF document text
- https://mabuksusu.com/contents//files/79389804518.pdfIn PDF document text
- http://www.sunarnuricomuisvealisverismerkezi.com/wp-content/plugins/super-forms/uploads/php/files/5rhmqa33at8ptr0ir00fruljk6/nuzezujalenoji.pdfIn PDF document text
- https://jamuiboe.com/webroot/upload_media/79342756041.pdfIn PDF document text
- https://edarky.net/data/file/rodulekavotadezuwezubat.pdfIn PDF document text
- http://cucthongke.vn/userfiles/file///lolelegebuvibonine.pdfIn PDF document text
- https://eclipsetheaters.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608549dd33df6---gapowuxedesat.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f5f5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF5F5	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off00010e06.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10E06	16168 bytes
SHA-256: `2f088311e3cc47affea05821c2def65328b1f74a195200b1b3e81469be6e99d2`
`font_02_sfnt_off000123a3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x123A3	17328 bytes
SHA-256: `fbce67aaee2d23a6a66bdd6b923f7783a78e0ee2b1a1106ef0aeeea02f0b9299`
`font_03_sfnt_off0001513d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1513D	10724 bytes
SHA-256: `d8a2f27fa3d176cac471fa78566370e21c58f1923dc9a69b0e00f10fdf2a2098`

Open this report in the interactive analyzer, or submit your own file for analysis.