Malicious PDF — malware analysis report

Static analysis result for SHA-256 506a4167fb76c709…

MALICIOUS

PDF

67.9 KB Created: 2021-09-03 20:16:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-31
MD5: 39c965cf1f5b38a9aea455ad8f952241 SHA-1: 8c9b5d13fda2d1b06c3c30f98829565137af0211 SHA-256: 506a4167fb76c709dd6eff9868f049e76fb3a6848481f690113d05f460c417a3
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, many of which point to compromised WordPress sites and disposable domains, indicating a link farm designed to redirect users. ClamAV detection as 'Pdf.Phishing.Trojan' further supports its malicious nature. The primary attack pattern involves luring users through a malicious attachment to click on these links, potentially leading to phishing or malware downloads.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4816

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ministerium.pt/files/89048381226.pdf In PDF document text
    • https://www.nobleorthodontic.com/wp-content/plugins/super-forms/uploads/php/files/a0032a2f4f4d1a8075a9760b1fd6a26a/92930254946.pdfIn PDF document text
    • http://vitacanes.com/uploads/files/revadasonexudupitepasujen.pdfIn PDF document text
    • https://bokseinstituttet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160e03d6357149---nupuvemomazuno.pdfIn PDF document text
    • https://parklanehotel.asia/userfiles/file/revipobajuvozof.pdfIn PDF document text
    • http://english-island.pl/wp-content/plugins/super-forms/uploads/php/files/cbn6ohee34stblrmmqn18kncn3/kizewetumuzapomirupil.pdfIn PDF document text
    • http://flex-link.cn/uploadfiles/files/20142229169.pdfIn PDF document text
    • http://moristas.com/userfiles/files/naxajitori.pdfIn PDF document text
    • https://www.nexidia.it/wp-content/plugins/super-forms/uploads/php/files/30c9621a0daba95d1e47ab856a113bc6/20294534250.pdfIn PDF document text
    • http://frutapac.com/ckfinder/userfiles/files/givanujamiluzekaxepumur.pdfIn PDF document text
    • http://galaxyjewel.cn/uploadfile/files/139837165.pdfIn PDF document text
    • http://hamyarsanatco.com/ckfinder/userfiles/files/gobajelega.pdfIn PDF document text
    • https://canvasations.com/wp-content/plugins/super-forms/uploads/php/files/nr0ru63dbukrfei7gs0lb22o56/3404064307.pdfIn PDF document text
    • https://www.alpha-dynamics.gr/wp-content/plugins/formcraft/file-upload/server/content/files/1609b4266dfe3e---jitorefeso.pdfIn PDF document text
    • https://christembassybarking.org/wp-content/plugins/super-forms/uploads/php/files/1d7dc7035a0ad1655f512ce0b2ee329a/defofetidemagadazowedux.pdfIn PDF document text
    • http://www.appsolutely.sg/wp-content/plugins/formcraft/file-upload/server/content/files/16086a4109175c---39018403885.pdfIn PDF document text
    • http://benhvientantao.com/img_duhoc/files/votulijidu.pdfIn PDF document text
    • https://goactive.hu/wp-content/plugins/super-forms/uploads/php/files/b83ebe771189ec7c45365a19bb8a69cd/pixixadewofotomaf.pdfIn PDF document text
    • http://challendor.com/fckeditor/upload/file/84970716964.pdfIn PDF document text
    • http://www.macrolepidoptera.hu/userfiles/files/95040926382.pdfIn PDF document text
    • https://arvikabc.com/images/uploadedimages/file/68695671720.pdfIn PDF document text
    • https://beaufortbond.com/wp-content/plugins/super-forms/uploads/php/files/a95246e7bc32582a5015007f9ccb8c74/zozabalawogujil.pdfIn PDF document text
    • http://sunnysidehighschoolclassof59.com/clients/867562/File/74995301205.pdfIn PDF document text
    • http://veronicanealhome.com/wp-content/plugins/formcraft/file-upload/server/content/files/2/1612db0b1006df---27175151589.pdfIn PDF document text
    • https://apexforestservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bc3042e9629---77363384964.pdfIn PDF document text
    • http://world-green-hope.com/uploads/files/89239893993.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=cultura+chavin+ceramica+pdfPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.