Malicious PDF — malware analysis report

Static analysis result for SHA-256 38a2f488755992e1…

MALICIOUS

PDF

64.3 KB Created: 2021-06-15 21:51:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d8aa77586722d095d0460a6bbd872c48 SHA-1: 1707c36a044d63b5c17214afa93af68781da0aff SHA-256: 38a2f488755992e14e77adf4871024843b4872552459a3ed26d89c0d45f5a10d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, with numerous URLs pointing to compromised WordPress sites and potentially malicious content. The presence of 'utm_term' parameters in some URLs suggests an attempt to track user engagement with phishing or scam content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9850

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=small+penus+humiliation PDF link annotation
    • http://www.iamgoingto1996.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609f041bec8b6---sigajakizegubamofujog.pdfIn PDF document text
    • https://auto826.com/uploads/files/38218045124.pdfIn PDF document text
    • http://www.maarsehoveniers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608fa4e387f04---54334334248.pdfIn PDF document text
    • http://www.jesuseslaroca.org/wp-content/plugins/formcraft/file-upload/server/content/files/160abebed36480---fejikozuzifubojenofirezif.pdfIn PDF document text
    • http://debandhelder.nl/ckfinder/userfiles/files/62707245864.pdfIn PDF document text
    • http://neuragen.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607ef5799ee9b---jupipuronixel.pdfIn PDF document text
    • https://cutletsmeat.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089a6c2a6f5a---59745160817.pdfIn PDF document text
    • http://cesishotel.com/res/wysiwyg/file/56608361016.pdfIn PDF document text
    • https://autotrilogy.com/wp-content/plugins/super-forms/uploads/php/files/6399126cd0a9eb1e884cd15c57d78b90/wejodiw.pdfIn PDF document text
    • https://bf-pomosch.ru/wp-content/plugins/super-forms/uploads/php/files/o87qf538fvjb2opm52njp2c4a0/kotokef.pdfIn PDF document text
    • https://cms.blauraum.com/wp-content/plugins/super-forms/uploads/php/files/28edb84b2a0b37a9ded03c9520988647/48596326251.pdfIn PDF document text
    • https://rebel-guitars.com/wp-content/plugins/super-forms/uploads/php/files/7e7a10c24db6ba90391fdb0f7adf08de/banununujaw.pdfIn PDF document text
    • https://www.toptalentusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/160946d62f194b---88980219961.pdfIn PDF document text
    • https://livingcircles.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1608752ae97de8---93095562116.pdfIn PDF document text
    • https://sakitonus.ru/wp-content/plugins/super-forms/uploads/php/files/7e98f428c6932c5b5cdcdc305156941b/8055700847.pdfIn PDF document text
    • https://www.straightmyteeth.eu/wp-content/plugins/super-forms/uploads/php/files/cb55e37f85eee775208c04e722964d6a/98705267927.pdfIn PDF document text
    • https://web-sila.ru/wp-content/plugins/super-forms/uploads/php/files/2f59573e6249f19ffbd393dbf50fa0ce/ganek.pdfIn PDF document text
    • http://www.mueblesgamez.com/ckfinder/userfiles/files/44681744851.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1ec.bin
7667a82228e3039b3abb03ddd75c304b69f773d198b8eae99e97bf5625a1d7ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1EC 5068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.