Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ac4df4c33113a77…

MALICIOUS

PDF

58.7 KB Created: 2021-06-09 02:33:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 7dbe22aa056c4c7ce8b8512b4ce70f6a SHA-1: 9587ce12b9bf0c768414ff4537261623851cec60 SHA-256: 4ac4df4c33113a77f8319bc2f82441b5cd69f821f08edc5c29a3437d35db6622
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a link farm pointing to multiple compromised WordPress sites, likely intended to trick users into downloading malware. The presence of 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM' heuristics, along with the ClamAV detection, strongly indicates a phishing or malware distribution attempt. The document body's reference to 'Lego marvel super heroes 2 mobile apk' serves as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7320

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crysiq.ru/uplcv?utm_term=lego+marvel+super+heroes+2+mobile+apk PDF link annotation
    • http://endustriyelkiralama.com/wp-content/plugins/super-forms/uploads/php/files/hnbi9rcr6ndnkktq703cgt5hqc/muronanalekefez.pdfIn PDF document text
    • https://dezsredstvompx.ru/wp-content/plugins/super-forms/uploads/php/files/1f5d8139c0a6a45b3d496d2e0418da7e/19551311997.pdfIn PDF document text
    • http://skncn.com/u/files/48459018872.pdfIn PDF document text
    • https://alfa-clining.ru/wp-content/plugins/super-forms/uploads/php/files/46a840e5603034de4222a2737b650e1c/numutegisal.pdfIn PDF document text
    • https://www.dyna-tech.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1609e1d0b2b181---92842095730.pdfIn PDF document text
    • https://www.budgetskemaet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160a001b4d71ac---gujumuniwoxubi.pdfIn PDF document text
    • https://atphp.ch/userfiles/file/bifatisuseva.pdfIn PDF document text
    • https://gofropack.com/wp-content/plugins/super-forms/uploads/php/files/6e8dfb957af7701ace2d212987d979a2/nefobesofifigiwitomiwofa.pdfIn PDF document text
    • https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a3c7048e953---fuvagabexiwax.pdfIn PDF document text
    • https://www.rydalmereprestige.com.au/wp-content/plugins/super-forms/uploads/php/files/n5i4r0c2ns79jdjlhnttqs3vp3/mamodimuvuga.pdfIn PDF document text
    • http://www.blackhillsdancecentre.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bfed00b1856---pegalegugewebage.pdfIn PDF document text
    • https://bykevin.com/wp-content/plugins/super-forms/uploads/php/files/0bf2efd0d1ed71cb6350fecbe37d0b04/82068493270.pdfIn PDF document text
    • https://dtcprojects.com.au/wp-content/plugins/super-forms/uploads/php/files/n5nreeq0mul00hc18p1ms9f6hf/55930130015.pdfIn PDF document text
    • http://counterreaction.net/wp-content/plugins/formcraft/file-upload/server/content/files/160bf9814e0fe5---76053177161.pdfIn PDF document text
    • https://ontime-taxi.kg/wp-content/plugins/super-forms/uploads/php/files/2bd8471996f8df3d104f1661b4d67652/45710712191.pdfIn PDF document text
    • http://bezpieczna-strefa.pl/wp-content/plugins/super-forms/uploads/php/files/3edbea6db2a20d11a75fcff726532601/98383492471.pdfIn PDF document text
    • https://www.dynasil.com/wp-content/plugins/super-forms/uploads/php/files/a796ce16557a94972935450aa5a5f113/somovomuz.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.