Malicious PDF — malware analysis report

Static analysis result for SHA-256 7eb0309de8fc8911…

MALICIOUS

PDF

95.6 KB Created: 2021-08-02 12:10:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: d401ae2471e3254671584b704d396835 SHA-1: b009569ebeb4aa30379d69220c99742461085635 SHA-256: 7eb0309de8fc89115835e075d23a73deedccf741ef93f34d6fe0364e223f84fb
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous external links, many hosted on compromised WordPress sites or disposable domains, indicating a link farm designed to redirect users to malicious content. The ClamAV detection and ML classifier strongly suggest this PDF is malicious, likely serving as a lure for phishing or malware downloads. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5264

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/uplcv?utm_term=psicolog%C3%ADa+educativa+anita+woolfolk+12+edici%C3%B3n+descargar PDF link annotation
    • https://hotelmitrutarija.com/uploaded/files/55929590368.pdfIn PDF document text
    • https://ecomassage.pt/wp-content/plugins/super-forms/uploads/php/files/m0kvencfb3r87uei260mmh00sn/71639669243.pdfIn PDF document text
    • https://zniczekowalczyk.com/user_images/file/53937716300.pdfIn PDF document text
    • http://petgears.com/app/webroot/files/file/paxodezagalim.pdfIn PDF document text
    • http://vdgairconditioning.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160acf0ed86e14---31667190457.pdfIn PDF document text
    • http://www.bridalchapel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077685344a69---bosurarovaxajokoma.pdfIn PDF document text
    • http://aiaciran.org/cache/fck_files/file/65639942323.pdfIn PDF document text
    • http://www.kliningstroy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1607517f310c19---sazexazejuwojobetemo.pdfIn PDF document text
    • http://przedszkolenisko.pl/userfiles/file/rekobumokusekikuzo.pdfIn PDF document text
    • http://www.akutrans.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609aab4a6b95d---xagiboxaduxopezamadewumo.pdfIn PDF document text
    • http://arabic.cz/ckfinder/userfiles/files/40513895083.pdfIn PDF document text
    • http://geology.ie/wp-content/plugins/formcraft/file-upload/server/content/files/1608f47ea504b8---37638021304.pdfIn PDF document text
    • http://smit-electronic.hr/upload/datoteke/85717476891.pdfIn PDF document text
    • https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/de6a5f3a009ca8241f1c172c3fa24728/lixipiwibobepekilemugi.pdfIn PDF document text
    • http://go-trec.com/wp-content/plugins/super-forms/uploads/php/files/r87ke014mactetop8ibebb90o0/lesarifarax.pdfIn PDF document text
    • https://parisautotravel.com/wp-content/plugins/super-forms/uploads/php/files/38i5r1e2mh2lui19es921jsdc3/jikexiwosewasido.pdfIn PDF document text
    • https://bonpetsupply.com/wp-content/plugins/formcraft/file-upload/server/content/files/160790636a7595---zanem.pdfIn PDF document text
    • http://cy2hand.com/userfiles/wefavan.pdfIn PDF document text
    • http://www.bridalchapel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bd6265c4453---45809301753.pdfIn PDF document text
    • https://sketchup360.vn/wp-content/plugins/super-forms/uploads/php/files/muspot2rda29bbifvm8u6nnppl/33981283269.pdfIn PDF document text
    • http://geose.ru/userfiles/file/13483044798.pdfIn PDF document text
    • https://samiznojmo.cz/wp-content/plugins/super-forms/uploads/php/files/c98d541cf3465a6ebccd39d7f8f28745/71515017394.pdfIn PDF document text
    • https://www.dolphinrfid.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078596f1abd5---lexebi.pdfIn PDF document text
    • https://rhythmcprandfirstaid.com/wp-content/plugins/super-forms/uploads/php/files/182f9e1e7ebfde1694da8f2a4bc40a26/bivuxudobo.pdfIn PDF document text
    • https://telenovella-bg.com/files/bixukesujunamarozejor.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.