Malicious PDF — malware analysis report

Static analysis result for SHA-256 770b070e57023a3b…

MALICIOUS

PDF

66.3 KB Created: 2021-09-01 15:54:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: c2b57c29bcc7f9adb3081b1dc7566262 SHA-1: 31b658da59de351d39428e548d3ff063795d57a1 SHA-256: 770b070e57023a3b5a0d5ba5562b46f2b2cab333aa5625ec113c6ee754cb15ea
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links to external websites, many hosted on compromised CMS uploads or disposable domains, suggesting a link farm or phishing lure. While no scripts were explicitly extracted, the PDF format and the nature of the links suggest potential exploitation or redirection to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9558

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://opusbiz.kr/data/editor/file/212016141860f081673a887.pdf In PDF document text
    • https://nikken-engineer.jp/export/sd205/www/jp/r/e/gmoserver/8/6/sd0748886/nikken-engineer.jp/fckeditor/upload/file/80471693832.pdfIn PDF document text
    • https://www.lokalesichtbarkeit.de/wp-content/plugins/super-forms/uploads/php/files/8ln95atg6k20r4ainkmaojf8vo/gedibamoxinagawaxu.pdfIn PDF document text
    • https://coloreverything.love/wp-content/plugins/super-forms/uploads/php/files/b5dc37bbf39e9d6b07009f5df289830b/92662711678.pdfIn PDF document text
    • http://annamsaigonlaw.com/upload/files/gosubofezigakufe.pdfIn PDF document text
    • https://norservis.com/files/files/kibitunezet.pdfIn PDF document text
    • https://precisionautoandac.com/wp-content/plugins/super-forms/uploads/php/files/c413393a9b1ce946f87a8b38cdcedc88/xokudakasa.pdfIn PDF document text
    • https://hohsingfiber.com/ufiles/files/pajutekonolig.pdfIn PDF document text
    • https://www.vibrationmonitoring.asia/wp-content/plugins/formcraft/file-upload/server/content/files/160850f4ab93d5---40176496884.pdfIn PDF document text
    • https://bursaceviritercume.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a1640a77ac7---77793270640.pdfIn PDF document text
    • http://makinsushi.com/uploads/files/45893042736.pdfIn PDF document text
    • http://www.eflox.net/wp-content/plugins/formcraft/file-upload/server/content/files/160fc7da3f3253---47599616741.pdfIn PDF document text
    • http://nt-module.ru/ckfinder/userfiles/files/xasolomoburofagaxikalazel.pdfIn PDF document text
    • https://wavesmaroochydore.com/wp-content/plugins/super-forms/uploads/php/files/7kb4539go4roiqgqebbh51ui6h/18793370089.pdfIn PDF document text
    • https://aymfly.com/aym_image/files/kafoxaperekakiber.pdfIn PDF document text
    • http://phanphoiongnhuahoasen.vn/upload/files/xoguvagubipe.pdfIn PDF document text
    • https://www.certificagreen.com/wp-content/plugins/formcraft/file-upload/server/content/files/160995d2c92b71---63623626851.pdfIn PDF document text
    • http://apexhealthnutrition.com/newerac2c/userfiles/file/rupokoxovepog.pdfIn PDF document text
    • http://linuxnewyork.com/draft/media//9489063903.pdfIn PDF document text
    • https://akdenizokullari.k12.tr/wp-content/plugins/super-forms/uploads/php/files/lfc55qmnnevvcol7at6cve8bh6/59161731499.pdfIn PDF document text
    • http://3bbb.fr/ckeditor/upload/files/74089260932.pdfIn PDF document text
    • https://www.lindopoint.it/wp-content/plugins/super-forms/uploads/php/files/298ec924230f7f43518438a8b2f6d6f4/11853910602.pdfIn PDF document text
    • https://cashmeredreams.com/wp-content/plugins/super-forms/uploads/php/files/6a876317e2320cd9581123f4063820f1/tesajudopekabuzit.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/1KS0DP0cxss/uplcv?utm_term=5+basic+french+saucesPDF link annotation
    • http://e1pl2.nazwa.pl/busy/fotki/file/51962421864.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.