Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f6cadd16896e2b3…

MALICIOUS

PDF

62.3 KB Created: 2021-08-10 04:02:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: da85dfabcd7096c5be92619b5345af58 SHA-1: 846f1df98587281f1d9876f3536176a1d856d7a3 SHA-256: 6f6cadd16896e2b31916d063c636fcf1c569877c253a8ad1f4516126369c02c6
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous external URIs and embedded links, many pointing to compromised WordPress sites, suggesting it is designed to lead users to malicious content. The presence of a link farm on disposable hosting further supports a phishing or malware distribution intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9489

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baileyelectrical.services/wp-content/plugins/super-forms/uploads/php/files/9obas3i7b39868ej7ffklhbii1/36491663686.pdf In PDF document text
    • https://lotteppta.net/beta/assets/file/luzudi.pdfIn PDF document text
    • https://reifenscho.de/wp-content/plugins/formcraft/file-upload/server/content/files/160b9a9a8ae72d---82049671170.pdfIn PDF document text
    • http://discarga.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c9b18673e19---31049293571.pdfIn PDF document text
    • http://ladyqueen.it/userfiles/files/sojudonobatubifezozapikaz.pdfIn PDF document text
    • http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/160866b05332bb---varodemagenumidum.pdfIn PDF document text
    • https://petroblend.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b31f0e3ea1a---narozewotutaluwokuvafa.pdfIn PDF document text
    • https://www.indoorclub-informa.com/boletines/img/file/94826059155.pdfIn PDF document text
    • https://sasalidayanisma.org/uploads/file/60174547956.pdfIn PDF document text
    • http://anhuifan.com/upload_fck/file/2021-5-15/20210515130322953986.pdfIn PDF document text
    • https://agilitynd.com/wp-content/plugins/super-forms/uploads/php/files/a78fab680e7db2b047083a20b9b69849/19350190467.pdfIn PDF document text
    • https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/fo0aua97tkbehoivva7ie1e7oa/wubividigi.pdfIn PDF document text
    • https://actorconseil.com/files/file/vujiregu.pdfIn PDF document text
    • https://ukmriptek.org/codeIgniter-hmvc/userfiles/files/dejewefatipukotaxadoni.pdfIn PDF document text
    • https://medius.sk/userfiles/file/vuden.pdfIn PDF document text
    • https://stewsites.com/wp-content/plugins/super-forms/uploads/php/files/aaf541e76161d835d13c161ccecf344f/kikekenatejukorasizum.pdfIn PDF document text
    • http://hong-tour.com/FileData/ckfinder/files/20210720_3156F0DBA65B5B60.pdfIn PDF document text
    • https://amezdigital.com/wp-content/plugins/super-forms/uploads/php/files/2944d6f01253c9852b44c894c6046446/11390646824.pdfIn PDF document text
    • https://mariapolis.net/ckfinder/userfiles/files/6058401573.pdfIn PDF document text
    • https://ises.ca/phpsites/vertical_living/uploads/file/nomufafemi.pdfIn PDF document text
    • https://balticstroy.com/uploads/files/juximirozuvaburevuguwip.pdfIn PDF document text
    • https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/re2ruhl8chdmol8gprfqk0ml3g/43073334752.pdfIn PDF document text
    • http://grandinhr.eu/images/user/file/77199624201.pdfIn PDF document text
    • https://scavilecis.it/userfiles/file/mataxipe.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=baby%27s+day+out+full+movie+hindi+dubbed+free+downloadPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.