Malicious PDF — malware analysis report

Static analysis result for SHA-256 42961a3d7193b086…

MALICIOUS

PDF

55.3 KB Created: 2021-09-23 06:06:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-31
MD5: 4f982fb59f36a2ccc1b08fd8b6fe2577 SHA-1: 4e35b663311137cde2ca666b38d3b01a0b2d0b45 SHA-256: 42961a3d7193b086429cdbd3c3aba54c0af97e0511d2edac326cb37d03fbca32
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate the presence of link farms pointing to compromised CMS uploads and disposable hosting, suggesting a phishing or malware distribution attempt. The embedded URLs, while some are benign, are part of a broader pattern of directing users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8211

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ciskmv.com/css/file/pakipobutatugu.pdf In PDF document text
    • http://bjerkelunden.org/content/files/userfiles/file///lokeni.pdfIn PDF document text
    • http://nebovsem.ru/app/webroot/files/files/20698695344.pdfIn PDF document text
    • http://progfin.pl/userfiles/file/lukurixajupipegizotidafu.pdfIn PDF document text
    • http://humanlitech.com/files/files/gesujopuzepim.pdfIn PDF document text
    • http://shipsupply.ru/userfiles/files/pilepibev.pdfIn PDF document text
    • http://markasib.ru/ckfinder/userfiles/files/tuwuvigexoge.pdfIn PDF document text
    • http://www.sunarozlem.com.tr/wp-content/plugins/super-forms/uploads/php/files/2afil5hf3lgp46307u04fhkp13/31584705426.pdfIn PDF document text
    • http://tiszaikaland.hu/upload/file/56726373409.pdfIn PDF document text
    • https://indiansabroad.uk/userfiles/file/fivafu.pdfIn PDF document text
    • http://xn----0tbbbfo0f.xn--p1ai/userfiles/file/mefetakata.pdfIn PDF document text
    • http://shangyi-pump.com/uploads/file/230807207195.pdfIn PDF document text
    • https://ikorti-iao.com/userfiles/files/21188552469.pdfIn PDF document text
    • https://g4m3s-4p1-12s1.com/contents/files/gobikoruditivon.pdfIn PDF document text
    • https://www.passion-rnd.com/upfile/files/2021/09/14/wojunawer.pdfIn PDF document text
    • http://ateliergermain.org/sites/default/files/file/tufexobanenivopuraba.pdfIn PDF document text
    • http://vandervalk.reviews/app/webroot/files/userfiles/files/wojefevela.pdfIn PDF document text
    • https://hoakhanh.vn/uploads/image/files/fesaniwulibijilimom.pdfIn PDF document text
    • https://cfaegaianascente.pt/portal/userfiles/files/biwajakejifugenozago.pdfIn PDF document text
    • https://www.grecosalesinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613a9fd7cc2f9---defezunugibasodenur.pdfIn PDF document text
    • http://pocatellocampfire.com/wp-content/plugins/super-forms/uploads/php/files/5sgcneqg53mdtdm1jg74ajddj1/10259635515.pdfIn PDF document text
    • https://coffotea.com/uploads/files/202109092011543081.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/6naE_Nh8_CY/uplcv?utm_term=apa+itu+jelly+bean+androidPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.