Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c4a45fb6ebfce4f…

MALICIOUS

PDF

116.5 KB Created: 2021-06-26 06:00:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: 8a5aab731a55b9750733e1428e3c9f0d SHA-1: 0428ad2f33cf42546fbcdb7dc2fb457b6f99bb0c SHA-256: 1c4a45fb6ebfce4fd8030983b765e82ca82b3a5dd810da86f1f2b19a31de24fe
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links to compromised WordPress upload directories and other disposable hosting, suggesting it is part of a link farm designed to distribute malicious content or phish users. While no scripts were directly extracted, the PDF structure and heuristic firings indicate a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5631

Heuristics 4

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cottonweb.net/userfiles/file/89304101624.pdf In PDF document text
    • http://jncs.kr/page_data/file/20210606094153.pdfIn PDF document text
    • http://svs-pm.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c93e0729538---vazofonexumuditojawilu.pdfIn PDF document text
    • https://maspacientes.es/wp-content/plugins/super-forms/uploads/php/files/a30dm1lb85aojdfevq2iu0nf61/zuwisasaxeb.pdfIn PDF document text
    • https://rjiminfra.com/wp-content/plugins/super-forms/uploads/php/files/c53db0ba69c116150b72b274ac74654f/71485068006.pdfIn PDF document text
    • https://baigiangtoanhoc.com/upload/files/5644584094.pdfIn PDF document text
    • https://braviengenharia.com.br/wp-content/plugins/super-forms/uploads/php/files/et0vvt4adlsbt9go7s9fg538iq/tiwizafenewigo.pdfIn PDF document text
    • http://www.fullmooneye.com/wp-content/plugins/formcraft/file-upload/server/content/files/160757bb17c070---gowitopo.pdfIn PDF document text
    • http://www.hkqi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b328d9df944---xoxepozutiloto.pdfIn PDF document text
    • https://europartner2.pl/uploads/69738507357.pdfIn PDF document text
    • https://www.phoenixdentalacademy.co.uk/wp-content/plugins/super-forms/uploads/php/files/3cf664ed433bb9f1d687cd799395ae8e/buvijoxuvilunam.pdfIn PDF document text
    • https://www.truesdalepainting.com/wp-content/plugins/formcraft/file-upload/server/content/files/160741a842c7c9---46640346576.pdfIn PDF document text
    • https://www.truesdalepainting.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cb3a089e76---gisulolajefojadusera.pdfIn PDF document text
    • https://yssnewlessons.org/UserFilesTwo/file/17488074281.pdfIn PDF document text
    • http://www.suffaheducation.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a02d43a2184---22886020730.pdfIn PDF document text
    • https://propbrains.com/wp-content/plugins/super-forms/uploads/php/files/tf25k9j1v6l131gobrj4rf53a1/65176511288.pdfIn PDF document text
    • http://www.siscard.com/wp-content/plugins/formcraft/file-upload/server/content/files/160750b7b556cc---vusomaga.pdfIn PDF document text
    • http://mfplus.ba/wp-content/plugins/formcraft/file-upload/server/content/files/16070485a37371---nalogelidogupi.pdfIn PDF document text
    • https://trucraftsmanship.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090e738ce943---6387662539.pdfIn PDF document text
    • http://lalitas-thaimassage-spa.de/wp-content/plugins/formcraft/file-upload/server/content/files/160aa69c4277ed---tosuj.pdfIn PDF document text
    • http://fine-cottage.ru/userfiles/file/10992376993.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=nintendo+3ds+operations+manualPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.