Malicious PDF — malware analysis report

Static analysis result for SHA-256 201920f6e181cc8f…

MALICIOUS

PDF

149.9 KB Created: 2021-07-27 02:34:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: 49099f436099298a351bca58d173c690 SHA-1: 93104fa25b0f01dae007f66a60da376c08b874a6 SHA-256: 201920f6e181cc8f19e20f9b568a6c8730aed709885a2f4182b958aad0435592
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a link farm with numerous URLs pointing to potentially compromised websites, suggesting an attempt to direct users to malicious content. The presence of multiple distinct hosts and the use of 'utm_term' parameters in some URLs further support the classification as a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9498

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tuzvedo.hu/elemek/file/91793710280.pdf In PDF document text
    • https://xlux.vn/wp-content/plugins/super-forms/uploads/php/files/f898kvh7uk4qhcuucm3tbtk4h7/zuriliji.pdfIn PDF document text
    • http://ganan10.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/160d9186dcdcdd---90976138746.pdfIn PDF document text
    • http://eshop-kocicinadeje.cz/files/file/beguvo.pdfIn PDF document text
    • http://rurisnet.org/images/file/tazaxemimupuvebizuwefij.pdfIn PDF document text
    • http://michardardillier.com/ckfinder/userfiles/files/22260088382.pdfIn PDF document text
    • http://yokohama-model.com/userfiles/files/6927774420.pdfIn PDF document text
    • http://lawcab.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16087f8fd38a1e---midemitusi.pdfIn PDF document text
    • https://www.ideaklinikkadikoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b4d24e4b41---sivetuzuseweduxu.pdfIn PDF document text
    • https://yar-net.ru/userfiles/file/17558823907.pdfIn PDF document text
    • https://torbay.ru/images/uploads/file/ritelitowa.pdfIn PDF document text
    • https://www.sblending.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16079ad8c76375---17457954948.pdfIn PDF document text
    • http://esthebel.de/userfiles/file/xomidawavodiseruseso.pdfIn PDF document text
    • https://www.adler-leitishofen.de/wp-content/plugins/formcraft/file-upload/server/content/files/160ec4c22727ba---rexuburatarikugatomene.pdfIn PDF document text
    • http://www.petercar0937494634.com/upload/img/files/momomizomiwofebu.pdfIn PDF document text
    • http://files.ibiza-ferien.de/file/xikaganisuxeviwufezob.pdfIn PDF document text
    • http://www.jhannahs.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bfc48ad6852---1763169883.pdfIn PDF document text
    • https://www.dishdivvy.com/wp-content/plugins/super-forms/uploads/php/files/c62da463f456fc0d805208302f5c35cc/xagonanalejekinez.pdfIn PDF document text
    • https://www.officinadelgustoroma.com/wp-content/plugins/super-forms/uploads/php/files/86b6c235ad3bf426544bb0b2b5757697/bexavajezol.pdfIn PDF document text
    • https://amatnieks.com/pictures/image/botamexinizo.pdfIn PDF document text
    • http://gabortech.com/admin/file/wizikelezev.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/GLLx1DTH0VQ/uplcv?utm_term=essential+words+for+ielts+pdfPDF link annotation

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.