Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f4c6ee6ae87acc1…

MALICIOUS

PDF

54.0 KB Created: 2021-06-25 19:42:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 04406e0f6ccc9e3ca84b1c76c7092818 SHA-1: 45c296f65d8bbddef77053f64847f9920c129e5c SHA-256: 2f4c6ee6ae87acc1d114de0b5a69891d535069d7ebb4157f2cf82c8c73496db3
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file is identified as a malicious PDF by ClamAV, indicating it's likely a phishing or malware distribution lure. Numerous heuristics indicate the PDF functions as a link farm, directing users to compromised WordPress sites and other disposable hosting. These links are designed to lead users to malicious content, aligning with a phishing or malware delivery attack pattern.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4912

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pabausa.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a50b44c551b---pidemiparafito.pdf In PDF document text
    • https://www.davinci.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1608a70740202d---17880268128.pdfIn PDF document text
    • https://parklanehotel.asia/userfiles/file/5424467432.pdfIn PDF document text
    • http://plusbateria.com/wp-content/plugins/formcraft/file-upload/server/content/files/16094a26d2cab4---87493726375.pdfIn PDF document text
    • http://nessium.fr/userfiles/file/vuxiwalejoju.pdfIn PDF document text
    • https://www.hintonassociates.com/wp-content/plugins/super-forms/uploads/php/files/7a7cb6b8ac3f1c50392629cdfb047fe2/46811590441.pdfIn PDF document text
    • http://discarga.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077213c2450d---22598514599.pdfIn PDF document text
    • https://www.rath-catering.de/wp-content/plugins/formcraft/file-upload/server/content/files/1609a2661f0ba4---40415756747.pdfIn PDF document text
    • http://adabaskimerkezi.com/upload/file/22270340970.pdfIn PDF document text
    • https://chetanaus.org/bheru/uploadfiles/file/dutumidujibokakif.pdfIn PDF document text
    • http://www.homefacelifters.com/wp-content/plugins/super-forms/uploads/php/files/3cacaaab44833131251e502619e0277c/zupurefafojemefete.pdfIn PDF document text
    • http://creativeindustries.ru/uploads/userfiles/file/jagajovupadikamoselak.pdfIn PDF document text
    • https://digidatadecolombia.com/wp-content/plugins/super-forms/uploads/php/files/edbc4c800805f91cba2b12046f8d37e8/94362603983.pdfIn PDF document text
    • http://www.multigacos.com/admin/uploaded/fck/file/kunom.pdfIn PDF document text
    • http://staging.impactredevelopment.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078a5c513502---93409597987.pdfIn PDF document text
    • https://traveltokiev.com/wp-content/plugins/super-forms/uploads/php/files/qggb4tclbh0vqbape9214bf123/91239723167.pdfIn PDF document text
    • https://lesura.net/userfiles/file/31173822612.pdfIn PDF document text
    • https://militarynetwork.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607501d79c48b---93309711592.pdfIn PDF document text
    • http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/boej38dd11so19fjnlvgsq3gp5/sotobewefoteralarodisu.pdfIn PDF document text
    • http://am-assets.com/aom/magnolia/userfiles/file/5140827343.pdfIn PDF document text
    • https://kodeac.com/wp-content/plugins/super-forms/uploads/php/files/d10jni5iqmn6iveaipm124rsmd/nefazofekusoximopudig.pdfIn PDF document text
    • https://kayakbranson.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f6e89a4d1b---milewedamimegilitebi.pdfIn PDF document text
    • http://nhuaduongnhapkhauaz.com/upload/files/91820753066.pdfIn PDF document text
    • https://beautifullifeuk.com/wp-content/plugins/super-forms/uploads/php/files/63f859d190ff7e920ecae31e6da1f974/59304502157.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/FevRqgeaUVY/uplcv?utm_term=ice+melting+science+experimentPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.