Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ec7b59d83f090ec…

MALICIOUS

PDF

85.9 KB Created: 2021-06-22 22:53:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fb7c79729490c8c705956a203bc2cc54 SHA-1: 6ff5853c37d2a7e31be81ab88adb6a88d3fa85bf SHA-256: 3ec7b59d83f090ecdd2013bb5ab51db0382dd5fb5aca44e48ea063931d3b6d90
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link farm designed to redirect users to various compromised websites, masquerading as a "Fallout 4 dance mod". The presence of multiple links on disposable hosting and compromised CMS upload storage indicates a phishing or malware distribution attempt. ClamAV detection as 'Pdf.Phishing.Trojan' further supports the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7794

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.americanapi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086e3a0d7f19---jujipedidinum.pdf
    • https://popcouncilinstitute.org/wp-content/plugins/super-forms/uploads/php/files/d17f7ce2ace87c780a9243522bac21fb/pisewek.pdf
    • https://trsbarriersdirect.com/wp-content/plugins/super-forms/uploads/php/files/77e3fka2mv0uii5s1jttu66p9q/84970464338.pdf
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/o8g9olevjiirq1rcn654qneu74/nuxemipemu.pdf
    • https://contact-house.com/fckeditor/upload/file/zafovanuluxopu.pdf
    • http://cwesp.biz/upload/file/nelewefigixuvexalujojako.pdf
    • https://hcs1000.org/wp-content/plugins/super-forms/uploads/php/files/d17b8f576b6e041d76e939fe63726e5c/75029696958.pdf
    • http://perfectthesale.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cfcf41192a9---tutovalagiritifosorifafu.pdf
    • http://meyanko.com/userfiles/file/%5C/tugowedi.pdf
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/7lilqo4qpd13cvrkeno9lm8417/23248224934.pdf
    • http://www.sunargrup.com.tr/wp-content/plugins/super-forms/uploads/php/files/gjd113bplpfu4v1johg6e15n87/goxaxunovapenijaju.pdf
    • https://lorenzonimmigrationlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a55cea3dcf7---zimibadidetuguga.pdf
    • https://www.waterlooarmsnewforest.co.uk/wp-content/plugins/super-forms/uploads/php/files/b45c5912b6419669c83943f653a5fcc8/51215441563.pdf
    • https://boldvision.tv/wp-content/plugins/formcraft/file-upload/server/content/files/1609a1fb213da2---57787711674.pdf
    • http://www.hj-bouwt.be/wp-content/plugins/formcraft/file-upload/server/content/files/160b80b97439e1---87736313614.pdf
    • https://www.verpoort-bouw.be/wp-content/plugins/formcraft/file-upload/server/content/files/16086bcb836082---66505909915.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=fallout+4+dance+mod

Open this report in the interactive analyzer, or submit your own file for analysis.