Malicious PDF — malware analysis report

Static analysis result for SHA-256 01dbc356c77db7a6…

MALICIOUS

PDF

69.3 KB Created: 2021-06-26 07:09:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14
MD5: 324dd27da1faf16ed533bbd18b7733c1 SHA-1: 38433f3579c1fe88f8f388938c2021ea5cc15c59 SHA-256: 01dbc356c77db7a68adfe14a98ac6dac1e753821b7ea8564de764795f82972a1
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links pointing to compromised WordPress sites, indicating a link farm designed to redirect users to potentially malicious content. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent. The file's structure and the nature of the URLs suggest it is used as part of a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4829

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://southportrubbish.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a2d3493dc1a---8711982723.pdf In PDF document text
    • http://studiogiovannone.com/userfiles/files/13035558795.pdfIn PDF document text
    • http://accessiblevehicleservices.com/userfiles/file/57435367942.pdfIn PDF document text
    • https://www.cukoyem.com.tr/wp-content/plugins/super-forms/uploads/php/files/ftarkhran9lr8i6ctqonlqveo7/zalevivu.pdfIn PDF document text
    • https://www.heainc.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607704a4125ad---wugiruwulij.pdfIn PDF document text
    • http://alliance-ltd.com/userfiles/71412707557.pdfIn PDF document text
    • http://aristosaigonhotel.vn/uploads/files/latafefopimunafulos.pdfIn PDF document text
    • https://www.lokalesichtbarkeit.de/wp-content/plugins/super-forms/uploads/php/files/unbncdsbo22iu4s37m2otrpk81/84286335076.pdfIn PDF document text
    • https://www.alphaveneers.com/wp-content/plugins/super-forms/uploads/php/files/9c7fcd526b5b79f26f9c6a13a9b17cd8/19021350617.pdfIn PDF document text
    • http://www.danvillern.com/wp-content/plugins/super-forms/uploads/php/files/f3qj4u24elvo11135i2ejrp3f4/virapiwumepobagifawaxigob.pdfIn PDF document text
    • https://www.18fire.com/wp-content/plugins/super-forms/uploads/php/files/2bc3b374ad08c9baba07c44da23ca5c4/lefojizifesutogaxomofukix.pdfIn PDF document text
    • http://rocb-ap.org/file_media/file_image/file/32077514017.pdfIn PDF document text
    • http://ouhkpthaa.org/userfiles/75118006144.pdfIn PDF document text
    • https://www.brightfieldbusinesshub.co.uk/wp-content/plugins/super-forms/uploads/php/files/54ktnf2dc4a64gfece1gv8g94b/veragaxumapamak.pdfIn PDF document text
    • https://haysalon.com/public_html/userfiles/file/81035368997.pdfIn PDF document text
    • http://twxcd.com/img-aim/files/53975145005.pdfIn PDF document text
    • http://vudafrique.com/wp-content/plugins/super-forms/uploads/php/files/06b43cdffaac5aa411db00ebe5a98e13/82379181670.pdfIn PDF document text
    • https://paloaltospeakerseries.com/wp-content/plugins/super-forms/uploads/php/files/cd6e8f8bc5ba0f0091feaf2962ffc143/354811182.pdfIn PDF document text
    • http://www.radioemka.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609bcae81f0c7---79882356028.pdfIn PDF document text
    • http://argentum.com/wp-content/plugins/super-forms/uploads/php/files/5gojb26msel7qhk96pafpvigvh/56098821818.pdfIn PDF document text
    • http://techbis.pl/files/file/96433563301.pdfIn PDF document text
    • https://sumangold.net.vn/wp-content/plugins/super-forms/uploads/php/files/79tv6soe28ck3gs1qabrnofka6/zuleg.pdfIn PDF document text
    • http://scissortailfarms.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090a8f28a956---sagisukivuwakagosuber.pdfIn PDF document text
    • http://www.molinoag.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607de5ec45211---52516561074.pdfIn PDF document text
    • https://amkboiler.com/wp-content/plugins/super-forms/uploads/php/files/lnf6ridtpkpbsh9cph1jiaq6im/novowirupuzikidane.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/ngfLrbzwjls/uplcv?utm_term=seether+concerts+2021PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.