Malicious PDF — malware analysis report

Static analysis result for SHA-256 6119d70974b4129d…

MALICIOUS

PDF

81.8 KB Created: 2021-07-27 16:58:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 149a72741dbfa7981fc4beeda200059e SHA-1: 58b0614cccba940e237a6975af7f845743267d86 SHA-256: 6119d70974b4129daf94264429b42499842b1b056e922332751bbcef738cc3b4
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links, many pointing to compromised CMS uploads and disposable hosting domains, indicative of a link farm used for phishing or malware distribution. ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent. The ML classifier also flagged the PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8621

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://s-privod.ru/userfiles/file/vigawojuf.pdf In PDF document text
    • http://www.redactordecontenidos.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160a012294456f---dafuwovaguliba.pdfIn PDF document text
    • http://www.psstrecno.sk/wp-content/plugins/formcraft/file-upload/server/content/files/16070af38618c9---felazugoropobud.pdfIn PDF document text
    • http://imreelectric.sk/uploads/file/sotefumaloxusomabesef.pdfIn PDF document text
    • https://lcd96.ru/wp-content/plugins/super-forms/uploads/php/files/5ad173186049dc5324ad52246924311f/wovijume.pdfIn PDF document text
    • https://cevhertemizlik.com/userfiles/files/73733331630.pdfIn PDF document text
    • https://theatresaucinema.fr/uploads/file/fuzup.pdfIn PDF document text
    • http://etpatatietpatata.com/userfiles/files/wujazig.pdfIn PDF document text
    • http://classtool.info/upload/files/41128140801.pdfIn PDF document text
    • https://bonafideonline.com.ar/wp-content/plugins/super-forms/uploads/php/files/078599cd881bc443a3919b0bb602f249/dadojesixorodo.pdfIn PDF document text
    • http://mauchlineware.com/html/chapelstreet/web/userfiles/files/5187427409.pdfIn PDF document text
    • http://www.mvdisposal.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607caafe70fad---nuwufoguf.pdfIn PDF document text
    • https://seataclighting.com/wp-content/plugins/super-forms/uploads/php/files/7ae9d573d4cbfc4b13542939d01de1cc/waxadenudugarumozi.pdfIn PDF document text
    • https://www.mercedesbenzofaustinservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb2ff0da6b7---kifarifudaginezukogofi.pdfIn PDF document text
    • http://finsura-lifedirect.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160ab5f5fcac98---58710751091.pdfIn PDF document text
    • http://akinmedical.com/uploads/file/79488930678.pdfIn PDF document text
    • http://www.circoloaletrium.it/wp-content/plugins/formcraft/file-upload/server/content/files/160b9938b61c41---laramizudetum.pdfIn PDF document text
    • http://hawks79.com/clients/85064/File/68332648884.pdfIn PDF document text
    • http://www.circoloaletrium.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607c2f88e24d5---28954947184.pdfIn PDF document text
    • http://www.veronicaneal.com/wp-content/plugins/formcraft/file-upload/server/content/files/1/160987268af215---23314247289.pdfIn PDF document text
    • http://modra-skola.cz/userfiles/file/3211857719.pdfIn PDF document text
    • http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/53cc8d28a9fc576281b9d2afcd3311bf/91546114612.pdfIn PDF document text
    • http://108homed.com/userfiles/files/73910776519.pdfIn PDF document text
    • https://spencershaulageltd.co.uk/wp-content/plugins/super-forms/uploads/php/files/f4ef5345f130c99c102d680af30220a3/15706698799.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/ngfLrbzwjls/uplcv?utm_term=strait-line+sonic+laser+tape+manualPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.