Malicious PDF — malware analysis report

Static analysis result for SHA-256 0512877f17e99570…

MALICIOUS

PDF

51.2 KB Created: 2021-06-29 19:15:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-24
MD5: c406a448e5c664ec222dc8c5730556eb SHA-1: 14eb0da136b0da2f37294ebf90907b509ff7f711 SHA-256: 0512877f17e99570c7ce46dbddc9298b09d7e7a85371953d06cd4b9d7642fc2c
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links pointing to websites hosted on compromised CMS uploads and disposable domains, indicating a link farm designed to lure users to potentially malicious sites. The ML classifier and ClamAV detection strongly suggest malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9280

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/uplcv?utm_term=how+to+apply+iron+on+vinyl+with+iron PDF link annotation
    • http://biosite.ru/images/news/file/27474838251.pdfIn PDF document text
    • https://agilitynd.com/wp-content/plugins/super-forms/uploads/php/files/d9b9f5ca053d085eb54408a34fe62ffa/62599547873.pdfIn PDF document text
    • https://angkortaxiservice.com/userfiles/file/kafisi.pdfIn PDF document text
    • https://webgirls-studio.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a2f7b9427d---wikakubude.pdfIn PDF document text
    • https://tirthmobile.com/wp-content/plugins/super-forms/uploads/php/files/h91122hjikmcc9s1hkpebeept4/goxugitaxefuzudovoliwada.pdfIn PDF document text
    • http://call.ae/wp-content/plugins/formcraft/file-upload/server/content/files/1608aa0d3001cb---14539735324.pdfIn PDF document text
    • https://nailseasupportgroup.com/wp-content/plugins/super-forms/uploads/php/files/9632431485f2e1459f18a01355dade74/73774138171.pdfIn PDF document text
    • http://omniatel.it/wp-content/plugins/formcraft/file-upload/server/content/files/160b7ea40ef9a1---xigejanazifixufoliber.pdfIn PDF document text
    • https://www.grandiosa.is/wp-content/plugins/super-forms/uploads/php/files/epu9atuevjo122837hl3bhpmo0/ribasovutuw.pdfIn PDF document text
    • http://baharemadinah.com/wp-content/plugins/formcraft/file-upload/server/content/files/160db435559786---natonumugeweji.pdfIn PDF document text
    • http://mas.vacations/wp-content/plugins/formcraft/file-upload/server/content/files/160752dde71239---zepusabokogawapazuwuvuku.pdfIn PDF document text
    • https://marbellamohali.com/wp-content/plugins/super-forms/uploads/php/files/4c6a0cdf2bd3f010157bffc2bb2344a6/ginunagetoxen.pdfIn PDF document text
    • http://www.peplex.it/wp-content/plugins/formcraft/file-upload/server/content/files/1609e5009bf82c---35820129974.pdfIn PDF document text
    • https://www.hit-education.com/wp-content/plugins/super-forms/uploads/php/files/19q6rlm0arucoo1egsfnqv9nnh/40991509245.pdfIn PDF document text
    • https://stellabakingcompany.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b79a4f2b7f---mawupu.pdfIn PDF document text
    • http://opalsolar.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1608a699953a92---71630050293.pdfIn PDF document text
    • https://fullmagicweekend.com/ckfinder/userfiles/files/wubirezi.pdfIn PDF document text
    • https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/1c3c0f21894bd647c423f97829e81bdc/78376347602.pdfIn PDF document text
    • http://marinapogon.pl/upload/file/48234389046.pdfIn PDF document text
    • http://southportrubbish.com/wp-content/plugins/formcraft/file-upload/server/content/files/160844cc14da96---zusajituzakizif.pdfIn PDF document text
    • https://gancza-yacht.pl/userfiles/file/89229820597.pdfIn PDF document text
    • https://aashianarealty.com/file/38631654255.pdfIn PDF document text
    • http://rocincorporated.com/domain.com/images/dynamic_pages/file/76138763612.pdfIn PDF document text
    • https://www.kngroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/160732ebe52aff---zidevisudoloxalobak.pdfIn PDF document text
    • https://www.sevgiliyevideo.net/wp-content/plugins/formcraft/file-upload/server/content/files/160d4c0b157c2f---7248047449.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.