Malicious PDF — malware analysis report

Static analysis result for SHA-256 588016fde753b6d4…

MALICIOUS

PDF

62.5 KB Created: 2021-07-27 16:22:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24
MD5: a96dcc0c01c575d890d04d0c7a862083 SHA-1: a2d7bdcb6cf3adb560f35276ec212e399b126abf SHA-256: 588016fde753b6d495533e9ac847826011f77c8c4c49fd5bac7ca23f4a217819
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was identified as malicious by ML classifiers and ClamAV. It functions as a link farm, containing numerous URLs that point to compromised WordPress sites. These sites, in turn, host other PDF files, suggesting a multi-stage attack designed to distribute malware or conduct phishing operations. The presence of multiple compromised domains and the structure of the links indicate a deliberate effort to obscure the final malicious destination.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8900

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://comodee.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac126bc01b9---jaxavatufivefugowixab.pdf In PDF document text
    • https://event-connections.net/wp-content/plugins/formcraft/file-upload/server/content/files/160902a07e6948---sukokuzumewisifezuzix.pdfIn PDF document text
    • http://erfolgsapp.de/wp-content/plugins/formcraft/file-upload/server/content/files/160ec9f29adf0a---pixuxuzefaxe.pdfIn PDF document text
    • https://lisacutler.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609ba64e29570---68705337532.pdfIn PDF document text
    • http://soldresold.com/Shradhdha-Mehra/soldresold/final/ckeditorimage/files/29426417603.pdfIn PDF document text
    • https://www.gsccn.it/wp-content/plugins/formcraft/file-upload/server/content/files/160a07abd07075---50789655420.pdfIn PDF document text
    • https://homeaestheticsllc.com/wp-content/plugins/super-forms/uploads/php/files/950494b9d51578d4f9ec3bc0ecfb87a2/zilepubadupuxesubogum.pdfIn PDF document text
    • http://dchs1961.com/clients/871949/File/71039124005.pdfIn PDF document text
    • http://elitvorota.ru/f/file/negateti.pdfIn PDF document text
    • http://elonsummerstorage.com/wp-content/plugins/formcraft/file-upload/server/content/files/160952929d01bb---80051472459.pdfIn PDF document text
    • http://sva-jeanroze.com/xmedia/file/jatidelomibedawolonufow.pdfIn PDF document text
    • https://islandsvefir.is/wp-content/plugins/super-forms/uploads/php/files/r19damvvuv2t7ii0sp787jg9tf/renetelupuz.pdfIn PDF document text
    • https://alcc.vn/wp-content/plugins/super-forms/uploads/php/files/6g7pf1tcnc1oplrjjj7i305vv0/11245944588.pdfIn PDF document text
    • http://elonsummerstorage.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bfae5980bee---kinejenodafizakemeri.pdfIn PDF document text
    • https://worldkelo.com/wp-content/plugins/super-forms/uploads/php/files/4f2678d23bd6eca1c4796a7cefb8a818/ralabodewefilog.pdfIn PDF document text
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ee19314ff1e---30495854912.pdfIn PDF document text
    • https://betenagro.com/sites/default/files/file/tapowawobotodip.pdfIn PDF document text
    • https://nikosdimos.gr/userfiles/file/40456924122.pdfIn PDF document text
    • http://unsersohn.ch/images/file/44693498186.pdfIn PDF document text
    • http://ipjanah.ir/wp-content/plugins/super-forms/uploads/php/files/kssegbc8vjntfhq3msavhs6pm2/57434476229.pdfIn PDF document text
    • https://retentionstudentexperience.com/wp-content/plugins/formcraft/file-upload/server/content/files/160774c9c27da3---73474514823.pdfIn PDF document text
    • https://www.dynasil.com/wp-content/plugins/super-forms/uploads/php/files/a78c36812f07bc987b794150919aaa43/19435117615.pdfIn PDF document text
    • https://www.lipfish.no/wp-content/plugins/formcraft/file-upload/server/content/files/160a37b9268ae8---43631446935.pdfIn PDF document text
    • https://www.skyline-recruiting.com/wp-content/plugins/super-forms/uploads/php/files/c07531a5d1243d40b5068317d43f065b/wasumul.pdfIn PDF document text
    • https://ludifrance.fr/userfiles/file/witamu.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=how+do+you+use+an+omelette+maker+in+the+microwavePDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.