Malicious PDF — malware analysis report

Static analysis result for SHA-256 2380721bda6452c6…

MALICIOUS

PDF

62.4 KB Created: 2021-09-07 14:25:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: 37a800ecc33437251651edc774bbe394 SHA-1: e2c8e7de822d2f96ecc3fa59cca582a81fb31436 SHA-256: 2380721bda6452c6a8d7c25710a1abd2638a952bae71b361458c66f24fdaa698
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as a phishing trojan by ClamAV. Static analysis revealed it functions as a link farm, containing numerous URLs pointing to compromised CMS uploads and disposable hosting. These links are likely intended to redirect the user to malicious content, aligning with a phishing or malware distribution attack pattern.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4598

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ladychief.com/wp-content/plugins/super-forms/uploads/php/files/7055648b763c56bf497473207f230079/95197100799.pdf In PDF document text
    • http://subventionsbetrug.de/wp-content/plugins/super-forms/uploads/php/files/0vffi30s26rsv8ho9nnm6039fe/pirenejinopixipesinikaxov.pdfIn PDF document text
    • https://www.tessilgiada.it/wp-content/plugins/formcraft/file-upload/server/content/files/16073858dbbe67---49591457315.pdfIn PDF document text
    • https://otdelkamos.ru/wp-content/plugins/super-forms/uploads/php/files/c0878c91f912552d2959438574957032/59008283413.pdfIn PDF document text
    • http://halmar.info/userfiles/file/vizila.pdfIn PDF document text
    • https://nepalonetours.com/userfiles/files/lisabeguno.pdfIn PDF document text
    • https://west-holding.com/userfiles/file/rogakipuragumomejuzaxidu.pdfIn PDF document text
    • https://hoya.hr/UserFiles/file/subedemulefusadivit.pdfIn PDF document text
    • http://ozhelalikram.de/resimler/files/nitopevupegotoruzu.pdfIn PDF document text
    • http://flex-link.cn/uploadfiles/files/2536030060.pdfIn PDF document text
    • https://vdbergelectro.nl/wp-content/plugins/super-forms/uploads/php/files/78c1eacce12aad2d81165fe6a7d606da/6308584743.pdfIn PDF document text
    • https://www.hinogas.com/wp-content/plugins/super-forms/uploads/php/files/dikl2v0eqggkrrspld3m0jf60h/3161122962.pdfIn PDF document text
    • http://rialta.ie/userfiles/files/mozixukunarorujavaxamulaj.pdfIn PDF document text
    • http://cowmoo.org/ckfinder/userfiles/files/gopiloxutis.pdfIn PDF document text
    • http://www.caribbeandentist.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090b7ce4842e---35801898191.pdfIn PDF document text
    • https://kes-stv.ru/wp-content/plugins/super-forms/uploads/php/files/dd78e024ee0b08e3dfc2bc8208916ef5/62339218532.pdfIn PDF document text
    • http://oreade-breche.fr/userfiles/file/vixovedukukifulabiveruni.pdfIn PDF document text
    • https://syteq-pro.com/userfiles/file/26081406168.pdfIn PDF document text
    • http://realtor-madrid.com/uploades/fckeditorfile/zemiwosiva.pdfIn PDF document text
    • https://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/27fee89754a52c1c5510dc4f0cd0476c/nomifofotavuzudeno.pdfIn PDF document text
    • http://accessprecision.com/userfiles/file/wolemufiti.pdfIn PDF document text
    • https://lapalettedesarts.fr/gestion/file/tanaz.pdfIn PDF document text
    • http://asesoriazabalburu.org/azaba/files/file/sodoweviku.pdfIn PDF document text
    • http://mya1fc.com/files/ckuploads/files/37856382734.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=coordinating+conjunctions+worksheets+for+grade+7PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.