Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a3e6f8e83502d63…

MALICIOUS

PDF

67.6 KB Created: 2021-09-02 05:51:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 853d22900c020ef6ed6020fc6f5235c8 SHA-1: 66a60c9e6f962f13dc53fc92aa39e09d7f2555a8 SHA-256: 1a3e6f8e83502d639feda1ce2dfb8e3b40286c1a2afdade774f06a5f84901958
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was identified as malicious by a machine learning classifier and ClamAV, specifically flagged as a phishing trojan. Heuristics indicate it functions as a link farm, with numerous URLs pointing to compromised CMS upload directories. The document body is heavily obfuscated and appears to be generated content rather than user-readable text, further suggesting a malicious intent to obscure its true purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9552

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://akbmodel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608db1c2b85ae---jitizutimisiwexojemub.pdf In PDF document text
    • https://www.davidcosz.de/wp-content/plugins/super-forms/uploads/php/files/kfgornfgvsenj83p2sbith2dck/88811744811.pdfIn PDF document text
    • http://vitanova-cattery.com/upload/file/22006123748.pdfIn PDF document text
    • https://www.paparazzirestaurant.com.au/wp-content/plugins/super-forms/uploads/php/files/362130322d5a3efadc67d98055ce9343/59026186070.pdfIn PDF document text
    • http://www.nationaalgolfcongres.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160721db82af93---66294846096.pdfIn PDF document text
    • http://viviapalermo.com/userfiles/files/63191043246.pdfIn PDF document text
    • http://xn--80aafkqcanfpgnhbng3b5i9a.xn--p1ai/pict/file/fofemirugosunowepuz.pdfIn PDF document text
    • https://ukdirectremovals.com/wp-content/plugins/super-forms/uploads/php/files/2526d7fd1237b868d941e241245c45cd/zupunanerenejosarenezuto.pdfIn PDF document text
    • https://chp-travel.ir/data/file/wokalajujosojumupiz.pdfIn PDF document text
    • http://bora.su/ckfinder/userfiles/files/91095011421.pdfIn PDF document text
    • https://www.kadeavenue.com/wp-content/plugins/super-forms/uploads/php/files/14b59176f657b4cf5dac462cb870ee98/fosumugulosogopopirimub.pdfIn PDF document text
    • http://opuspointpartner.com/ckfinder/userfiles/files/92401627136.pdfIn PDF document text
    • https://www.hungarianassociation.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c0aa2055838---63881283281.pdfIn PDF document text
    • http://pogologistics.com/ckfinder/userfiles/files/xepitid.pdfIn PDF document text
    • http://www.salpasafarit.fi/tiedostot/files/mekinukosera.pdfIn PDF document text
    • https://searchlink.org/userfiles//file/taramusavitelewugomota.pdfIn PDF document text
    • https://www.cdscabling.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160e8e0c940c2a---fupijarozuribosumasenozur.pdfIn PDF document text
    • https://a2designbg.com/userfiles/file/89439135424.pdfIn PDF document text
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077715d6dcc7---38291698178.pdfIn PDF document text
    • http://iamsoldierfit.com/wp-content/plugins/formcraft/file-upload/server/content/files/16088258264cad---1469356850.pdfIn PDF document text
    • http://agrion.org/upload/fichier/14060745635.pdfIn PDF document text
    • https://best-label.com/upload/files/75042207269.pdfIn PDF document text
    • https://sipare.com.ar/wp-content/plugins/super-forms/uploads/php/files/h2m5brfb8u2h380h31ebk80r04/77892110287.pdfIn PDF document text
    • http://metrocars.london/survey/userfiles/files/fejefutapite.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3CAf4wW3hvY/uplcv?utm_term=is+wow+ptr+freePDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.