Malicious PDF — malware analysis report

Static analysis result for SHA-256 7dbbfd6ea66da761…

MALICIOUS

PDF

48.0 KB Created: 2021-09-29 06:05:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-23
MD5: 32cd0dc425f3ff0774f530db0aa7c63f SHA-1: 23c835666a41b8e0cd2b96fbceb36910df7bdabb SHA-256: 7dbbfd6ea66da761481eb4a1dba17a4eab2aa63ca937a6270071d0cad10319bf
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous external links, many pointing to compromised websites or disposable hosting, suggesting a phishing or redirection scheme. The ClamAV detection as 'Pdf.Phishing.Trojan' strongly indicates malicious intent, likely to lure users to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6441

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=android+keyboard+symbols+list PDF link annotation
    • http://jagodkaprzedszkole.pl/userfiles/file/wopifomibuwexigudaku.pdfIn PDF document text
    • http://puisan.ru/uploads/file/28088606293.pdfIn PDF document text
    • http://www.lnk-creation.fr/upload/file/70970322281.pdfIn PDF document text
    • http://hb-hospital.com/file_upload/fck_upfile/file/megute.pdfIn PDF document text
    • https://nikosdimos.gr/userfiles/file/74278885099.pdfIn PDF document text
    • http://arqing.es/ckfinder/userfiles/files/38634521873.pdfIn PDF document text
    • http://deleeuwputten.nl/site/data/ws/files/dapulux.pdfIn PDF document text
    • http://vladekoservis.ru/files/wusovugusisewubalegak.pdfIn PDF document text
    • https://veritiesinstitute.com/wp-content/plugins/super-forms/uploads/php/files/b746a69fedc8fecbc6ef99453f767478/82509464117.pdfIn PDF document text
    • https://birsamundapark.in/userfiles/files/30711011019.pdfIn PDF document text
    • http://logo4you.dk/userfiles/file/pozajotokiluvonoderota.pdfIn PDF document text
    • https://gamletaarnhuset.no/wp-content/plugins/formcraft/file-upload/server/content/files/16153b94bcebba---66803411878.pdfIn PDF document text
    • https://klaipeda.cvzona.lt/resources/img/files/luligeverefa.pdfIn PDF document text
    • http://msci.com.ng/wp-content/plugins/formcraft/file-upload/server/content/files/1614f765b46c19---fasumurufojosa.pdfIn PDF document text
    • https://oglethorpeclub.org/~oglethor/UserFiles/file/semexefepisusodosedal.pdfIn PDF document text
    • http://ksnjl.com/userfiles/files/sabikiwoga.pdfIn PDF document text
    • http://csc0535.com/userfiles/file/20210917234336_jtt12b.pdfIn PDF document text
    • http://c-six.it/userfiles/files/pemonifenotororilawipovo.pdfIn PDF document text
    • https://stayinbranson.com/ckfinder/triplebuserfiles/file/80870201878.pdfIn PDF document text
    • https://hasekei.jp/userfiles/file/6594107977.pdfIn PDF document text
    • http://htwy.com/upload/file/34628441961.pdfIn PDF document text
    • http://messtores.ca/fck_user_files/file/dokotanipagilisimenib.pdfIn PDF document text
    • http://nataliashishkina.com/userfiles/file/3878702047.pdfIn PDF document text
    • https://hijaustabilo.com/contents/files/namofaragewokuk.pdfIn PDF document text
    • http://pi-consulting.ch/download/18804369765.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.