Malicious PDF — malware analysis report

Static analysis result for SHA-256 579c03b25e2a7c65…

MALICIOUS

PDF

44.2 KB Created: 2021-07-13 13:23:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 7dd331629482fa1e28542e04527c5970 SHA-1: 9dc1a77517daa93b512e647e87d14e5bf6ebb4df SHA-256: 579c03b25e2a7c6570732bc30848a58dfb99d1c637625014d855fb2cfb9a43bf
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, with numerous URLs pointing to potentially compromised websites or disposable hosting, suggesting a phishing or malware distribution scheme. The presence of external URIs and link farms on compromised CMS uploads points towards an attempt to lure users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7407

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cructi.ru/uplcv?utm_term=the+seven+ages+of+man+questions+and+answers+pdf PDF link annotation
    • http://ccswcd.com/userfiles/file/tavafitovex.pdfIn PDF document text
    • http://www.combatsim.eu/wp-content/plugins/formcraft/file-upload/server/content/files/1607c7ec43b307---25696789269.pdfIn PDF document text
    • http://precedent.by/_newsite/images_from_html_editor/file/zemulekeruxowugulem.pdfIn PDF document text
    • http://www.ambredore.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089c8c2c3f39---11237952063.pdfIn PDF document text
    • http://skogsformedling.se/bilder_umeny/File/fufiv.pdfIn PDF document text
    • http://imhyuk.com/imhyukeditor/userfile/file/nubugumugobaratipaxezurim.pdfIn PDF document text
    • http://veronicanealhome.com/wp-content/plugins/formcraft/file-upload/server/content/files/2/1609ddf49bd7fa---49062578317.pdfIn PDF document text
    • http://ahlhy.com/uploads/file/090244443939.pdfIn PDF document text
    • https://www.msolartop.cz/wp-content/plugins/formcraft/file-upload/server/content/files/1607d1a06725a6---gotifakudafodoxulap.pdfIn PDF document text
    • http://mdc.ir/ckfinder/userfiles/files/vapibidanajuk.pdfIn PDF document text
    • https://edu-mate.kr/_UploadFile/Images/file/lawanoje.pdfIn PDF document text
    • http://dentalweek.eu/userfiles/files/zugalenagamatuwumuzi.pdfIn PDF document text
    • http://www.sunarsurdurulebilir.com/wp-content/plugins/super-forms/uploads/php/files/805kb1gtss9qahpjajopr6oio5/deweletitakakumos.pdfIn PDF document text
    • http://bjoybrands.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cced0782ae---xodoxowelitufikalot.pdfIn PDF document text
    • https://papiratisk.cz/soubory/sefekefezorezinujozodo.pdfIn PDF document text
    • https://www.tanyadantus.com/wp-content/plugins/super-forms/uploads/php/files/e24d2625e9f54c7cdeb0450ac47a8459/47152604731.pdfIn PDF document text
    • https://branchennachweis.eu/userfiles/file/81817687013.pdfIn PDF document text
    • https://tyeetomsfishing.com/userfiles/file/65150984855.pdfIn PDF document text
    • https://master.plus/wp-content/plugins/super-forms/uploads/php/files/135809322e01cbf2c1a02d911380a375/58031555925.pdfIn PDF document text
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/irjc6o4du91rc7d0nv21r8f448/gisodivev.pdfIn PDF document text
    • http://www.kliningstroy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160a47ba5519f2---92415435722.pdfIn PDF document text
    • https://virker-ikke.dk/files/lalikelanufi.pdfIn PDF document text
    • https://adbetelparaguay.com/wp-content/plugins/super-forms/uploads/php/files/687cf33d4df5e22d39e5ff961aac4fe9/lusixowex.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.