Malicious PDF — malware analysis report

Static analysis result for SHA-256 733f58a76ee88bdf…

MALICIOUS

PDF

46.0 KB Created: 2021-05-28 06:10:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 57b25508111f36acf23a20dc04ae2103 SHA-1: f2ece13c5ea8eb27d992aa6b98634b1a617327d8 SHA-256: 733f58a76ee88bdfad5646dc8c88d6e5f2b80ef2a214839324496f2ab96d8bc1
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and ML classifiers, indicating a phishing or trojan payload. It contains numerous links to external websites, many of which are hosted on compromised WordPress installations or disposable domains, suggesting a link farm designed to redirect users to malicious content. No scripts were extracted, but the PDF structure and linked URLs strongly suggest an attempt to deliver a secondary payload or phish for credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7939

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eperon-kochersberg.com/img_db/33983648491.pdf In PDF document text
    • https://gearforfree.com/wp-content/plugins/super-forms/uploads/php/files/jchg1hkrk6gtdneq6tf2j3slv0/88601627966.pdfIn PDF document text
    • http://www.sevenchurchestour.net/seven/wp-content/plugins/formcraft/file-upload/server/content/files/1609caa09ded8c---ruduguku.pdfIn PDF document text
    • http://smartmedicaleg.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070f4681d15d---vemokakewe.pdfIn PDF document text
    • https://yourtuscanyguide.com/wp-content/plugins/super-forms/uploads/php/files/5kss5jq6r3vv3p6u5e569vbpf2/jozuwumazis.pdfIn PDF document text
    • http://gingerwooddesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072b3171bba2---79277495620.pdfIn PDF document text
    • https://pensiuneavlasin.ro/wp-content/plugins/super-forms/uploads/php/files/tlunsk0ij4g2ij2rnf52oafmcr/zojef.pdfIn PDF document text
    • https://anfauglir.com/images/file/jatamisinuvutaleluji.pdfIn PDF document text
    • http://www.investing-in-women.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c4c686cb45---46881243700.pdfIn PDF document text
    • http://grupogmec.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077a19295c5b---85947442579.pdfIn PDF document text
    • http://zawayakw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160acbd1560791---wanodusixabirozinoviwume.pdfIn PDF document text
    • https://robotics-institute.com/wp-content/plugins/super-forms/uploads/php/files/q4u8cqskepqlgapvkbedvr8j8l/95166495796.pdfIn PDF document text
    • http://bronia.org/userfiles/file/sizebagoxefofosatapofasu.pdfIn PDF document text
    • https://alkhairi.co.uk/wp-content/plugins/super-forms/uploads/php/files/70bd8c11d0c532648279fb9eb050c4b3/43475345558.pdfIn PDF document text
    • http://alexanderkanevskyartistbiography.com/clientMedia/file/fasixeko.pdfIn PDF document text
    • http://www.sparkprototypes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ac6713fb72---sikakibokijuxe.pdfIn PDF document text
    • https://ipcare.nl/wp-content/plugins/super-forms/uploads/php/files/k99ib8kl0mgmb33sm39ikq6v3q/miwewesepiba.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/S30rS-6n6vg/uplcv?utm_term=aha+acls+costPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.