Malicious PDF — malware analysis report

Static analysis result for SHA-256 27f637631a49cef8…

MALICIOUS

PDF

113.8 KB Created: 2021-07-19 12:45:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: 4c086efe0fe695208dd7b4240983efc3 SHA-1: b5fd67a9c291fb07d45f0061ebf0e8d5e38fab91 SHA-256: 27f637631a49cef8165c81a3a8a2bc95525648c3ce40f954ab5b6ffb3a59e21d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded URLs pointing to various websites, many of which are hosted on compromised CMS uploads or disposable domains, indicating a link farm designed to distribute malicious content. ClamAV detection as 'Pdf.Phishing.Trojan' further supports its malicious nature. The ML classifier also flagged the PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5532

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://charivne.info/images/file/93995692973.pdf In PDF document text
    • https://gpuhub.net/wp-content/plugins/super-forms/uploads/php/files/8g9j4e92g5ndd6o820euqgfq23/bibudapebetalu.pdfIn PDF document text
    • https://karinbentum.nl/uploads/file/peperesatufuwakix.pdfIn PDF document text
    • http://www.studiolegalefusimorelli.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cbe4c4d5fa0---joxilixinedazewi.pdfIn PDF document text
    • https://ebooksweb.net/files/file/7829489098.pdfIn PDF document text
    • http://icltindia.in/userfiles/file/turagazi.pdfIn PDF document text
    • https://backcountryplayground.com/wp-content/plugins/super-forms/uploads/php/files/98e330446f7ce51aa82d3503e39abc66/58709742357.pdfIn PDF document text
    • https://mebelpozakazu.ru/wp-content/plugins/super-forms/uploads/php/files/8f6c42724c53aec05ca95ff982390b7c/96842850399.pdfIn PDF document text
    • http://www.loockuniformes.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/160be4a36375aa---teniberapelifawidumu.pdfIn PDF document text
    • http://topopentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b3074ea4362---23303810813.pdfIn PDF document text
    • http://kindervakantieweekdeurne.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160f3f5051a8fa---jovutijigenonez.pdfIn PDF document text
    • http://www.nisbd.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608224530e187---boveto.pdfIn PDF document text
    • https://www.dolphinrfid.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608cf5c9050bc---bulapitejofawifunopexuma.pdfIn PDF document text
    • http://accessiblevehicleservices.com/userfiles/file/xunirebedodigabobewimuko.pdfIn PDF document text
    • http://j-line.ca/fck_upload/file/jomijovabosowez.pdfIn PDF document text
    • https://www.ferienhof-schneider.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607586638dfe0---dijefogatokalup.pdfIn PDF document text
    • https://xaydungdonggia.com/app/webroot/files/images/pages/files/nosemelutamunubevul.pdfIn PDF document text
    • https://www.carlosfunes.es/wp-content/plugins/formcraft/file-upload/server/content/files/160a9be45d18a9---jegabunagigibojeviza.pdfIn PDF document text
    • http://greenbrier101.com/userimages/41025821592.pdfIn PDF document text
    • https://lakeshoresmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/fencmsqflc1jvtjgl8lniuvcb6/36989618483.pdfIn PDF document text
    • https://lee-trading.tw/archive/upload/files/lopogevakulunadodinavuli.pdfIn PDF document text
    • https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/0u7etkjh0ghnhc7s10r0qnh1sg/81292260486.pdfIn PDF document text
    • https://voolabs.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b0969bd8d8a---bozifonejiwa.pdfIn PDF document text
    • https://www.popcaffe.it/wp-content/plugins/super-forms/uploads/php/files/1e044f44deaf6092189d62563cec835e/lufosajufopuwi.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/LPIa9PGmDLg/uplcv?utm_term=olaf%27s+frozen+adventure+full+movie+in+english+part+1PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.