Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ae44545aaea6566…

MALICIOUS

PDF

46.5 KB Created: 2021-09-26 15:17:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: d65b3224cc16664a57cb4de140487714 SHA-1: fbbb3868233ff00879c3a348700d148cb251f4c1 SHA-256: 3ae44545aaea6566bb627bd3eaff4c965026c8071a16a1ca3d2b41e2caea5ac1
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, with numerous URLs pointing to various domains, including compromised WordPress sites. The presence of 'utm_term' parameters suggests an attempt to track user interactions, common in phishing or malware distribution campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7610

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://archism.ru/uplcv?utm_term=android+create+service+example PDF link annotation
    • http://aleeblog.com/wp-content/plugins/super-forms/uploads/php/files/th4i0okujdq7o73rsgqkkh7p96/vasotepidoxa.pdfIn PDF document text
    • http://be-now.pl/userfiles/file/20727746193.pdfIn PDF document text
    • http://elektro-galerie-hamburg.de/userfiles/file/27435322660.pdfIn PDF document text
    • http://mfcpavpos.ru/file/zojuvukudutasu.pdfIn PDF document text
    • https://indiansabroad.uk/userfiles/file/rifaxoroguverideli.pdfIn PDF document text
    • https://korzo-galeria.hu/files/file/29668373107.pdfIn PDF document text
    • http://hawaiisushi.iorderfoods.com/uploads/files/56268661906.pdfIn PDF document text
    • http://lab4050.com/upload/editor/file/zakifikoporoxotamakunoxet.pdfIn PDF document text
    • http://instant-image.net/UserFiles/Site/File/jadurexeg.pdfIn PDF document text
    • https://comobrew.com/newsite/images/user_uploads/file/safopawaz.pdfIn PDF document text
    • https://senarathgroup.lk/assets/media/file/29786636656.pdfIn PDF document text
    • https://metrosecuritynepal.com/assets/userfiles/files/togudebav.pdfIn PDF document text
    • http://vitalenzyme.com/uploads/fckupload/file/rowonupaledin.pdfIn PDF document text
    • https://clifestyle.net/uploades/userfiles/file/65343320272.pdfIn PDF document text
    • https://slide-bearing.com/d/files/zurematixuvinemaxijod.pdfIn PDF document text
    • http://omniatel.it/wp-content/plugins/formcraft/file-upload/server/content/files/16136f447df49f---24483002827.pdfIn PDF document text
    • http://unicorn-furnitures.com/d/files/pagovinadexuxu.pdfIn PDF document text
    • https://greenturtleproductions.com.au/wp-content/plugins/super-forms/uploads/php/files/a32ca3c61effd59bc7ae75dfa2543b03/92281959575.pdfIn PDF document text
    • https://ilonew.tasksplan.com/userfiles/files/31603977875.pdfIn PDF document text
    • https://worldpigment.com/image/upload/File/mogelutiwuwulesugunawo.pdfIn PDF document text
    • http://medicom.pl/userfiles/file/54100035937.pdfIn PDF document text
    • http://mqskin.com/luutru/files/89603603656.pdfIn PDF document text
    • https://apartmani-mestrovic-krk.hr/files/94410543583.pdfIn PDF document text
    • http://kingalbertltd.com/uploadedfiles/file/62797198364.pdfIn PDF document text
    • http://shiraz.sk/ckfinder/userfiles/files/76636902521.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.