Malicious PDF — malware analysis report

Static analysis result for SHA-256 41baba859809fc35…

MALICIOUS

PDF

64.4 KB Created: 2021-06-09 00:55:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 658eb94e452f26f1ea30d65ca400f349 SHA-1: 5e7900a2bcccad4a06bac1323ec96935a3728dee SHA-256: 41baba859809fc353f068581e1fdfaaacdf8ce3e0e37e83e79c71dcebddc67a8
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating it is likely a phishing or malware distribution lure. It contains numerous external URIs and embedded links, many pointing to compromised CMS uploads or disposable hosting, suggesting a link farm designed to redirect users to malicious sites. The document body is heavily obfuscated and contains metadata related to PDF generation, but no clear textual content that would indicate a specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7441

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/uplcv?utm_term=the+babysitters+club+pdf PDF link annotation
    • http://fonnepal.org/userfiles/file/66304294612.pdfIn PDF document text
    • https://www.gsccn.it/wp-content/plugins/formcraft/file-upload/server/content/files/1606ca8e5b3df5---1531311562.pdfIn PDF document text
    • http://www.majoriscambio.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1606d556da49f1---18663984511.pdfIn PDF document text
    • https://husvagnsexpo.se/wp-content/plugins/formcraft/file-upload/server/content/files/160730258680e5---nolovajidejinajere.pdfIn PDF document text
    • https://skyfireconsulting.com/wp-content/plugins/super-forms/uploads/php/files/bivoqgu9t31r8cjmsp6jlvi8c6/11139140534.pdfIn PDF document text
    • https://webupdate.ca/wp-content/plugins/super-forms/uploads/php/files/5lkgchetvhtmh0cc8taiv2s9f9/7088503300.pdfIn PDF document text
    • https://alianzatours.com/imagenes/file/pigujideloraf.pdfIn PDF document text
    • https://refour.dk/wp-content/plugins/super-forms/uploads/php/files/a1f04e465e08eaf88b6e00e824aec600/pezojuvulajutamanulezem.pdfIn PDF document text
    • http://alpha-cp.com/userfiles/file/42848504085.pdfIn PDF document text
    • http://zawayakw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160abe3ade4230---2186303976.pdfIn PDF document text
    • https://avela.md/userfiles/file/23676267253.pdfIn PDF document text
    • http://livestreaming.group/wp-content/plugins/super-forms/uploads/php/files/5dq03g7s173244af33bf3j5nd8rn50p4/barokevibijumov.pdfIn PDF document text
    • https://planet-for-events.de/userfiles/file/83143201389.pdfIn PDF document text
    • http://www.timtransportes.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/160be8ea3ef8ef---93540073153.pdfIn PDF document text
    • https://www.etbsupplies.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a9a8fd5962b---golivemopasatodolikereduz.pdfIn PDF document text
    • http://pospatrans.cz/UserFiles/File/72190067527.pdfIn PDF document text
    • https://gagiongvitgiong.com/ckfinder/userfiles/files/2581015332.pdfIn PDF document text
    • https://alkhairi.co.uk/wp-content/plugins/super-forms/uploads/php/files/da30c128f8da2f3f5af3bf5b0d2cc256/gabapudogobon.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.