Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ab8e34705843790…

MALICIOUS

PDF

52.2 KB Created: 2021-05-06 19:06:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 9642d51a675e9e21cd88b2b2102bc4a7 SHA-1: b82fb436dc01b1d695de7987b32cce626b59dd04 SHA-256: 5ab8e347058437906dfa71171abf1b5bd76efc23c28bb4c87b37f804837953f5
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links pointing to various domains, many of which are hosted on compromised WordPress sites. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a non-clustered link farm on disposable hosting, suggesting an attempt to manipulate search engine results or distribute malicious content. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7360

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://allytemp.ru/uplcv?utm_term=experimental+psychology+journal+free PDF link annotation
    • http://cargo3030.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1608180ff6793d---54499167709.pdfIn PDF document text
    • http://argra.rs/wp-content/plugins/formcraft/file-upload/server/content/files/1607e1ffea6c22---tazimif.pdfIn PDF document text
    • https://allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/a5a3d31516fc9652d8979bf0c866539d/neguxigarominuzodajeb.pdfIn PDF document text
    • https://floridaholidayplanner.com/wp-content/plugins/super-forms/uploads/php/files/7ad80186c54db5e9cb86472d1e766128/nilenak.pdfIn PDF document text
    • https://artsketch.ru/wp-content/plugins/super-forms/uploads/php/files/d61775960260109d19e60013c588998e/tawefuwufugefiwasoridaxaf.pdfIn PDF document text
    • http://www.saraviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079df6daa98b---33668112229.pdfIn PDF document text
    • https://cursosgratuitosonline.es/wp-content/plugins/super-forms/uploads/php/files/ausau0fgrec62ge1lpq6dceu5b/39530945335.pdfIn PDF document text
    • https://schreinerheusi.de/wp-content/plugins/formcraft/file-upload/server/content/files/16071687b08f13---dojogaserolarefotipoful.pdfIn PDF document text
    • https://comodee.com/wp-content/plugins/formcraft/file-upload/server/content/files/160883b63ee1fa---xapipokezuxo.pdfIn PDF document text
    • https://unique.global/wp-content/plugins/super-forms/uploads/php/files/8d254a222d697537b87d145ea9226a2e/peposawuga.pdfIn PDF document text
    • https://fiambreszav.com/wp-content/plugins/super-forms/uploads/php/files/99cdf71c9a95b6abccfa9fa5c6545851/58407930694.pdfIn PDF document text
    • https://www.lorenzofranzone.it/wp-content/plugins/super-forms/uploads/php/files/ac81b9aad14dac3811866ab066fe8af6/muwafokudivujutajarutab.pdfIn PDF document text
    • https://gdr.co.il/wp-content/plugins/super-forms/uploads/php/files/a933453b083a85f3493c8dffa218162c/35508496715.pdfIn PDF document text
    • http://bubblesoflove.net/wp-content/plugins/formcraft/file-upload/server/content/files/160928f2676f04---5750684519.pdfIn PDF document text
    • http://friluftsgruppen.se/wp-content/plugins/formcraft/file-upload/server/content/files/1607bac74866b5---10359797769.pdfIn PDF document text
    • https://balance-global.com/wp-content/plugins/super-forms/uploads/php/files/lhh01tm0deodd45f6ljekhsb40/15146750529.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.