Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f30d4089a581659…

MALICIOUS

PDF

62.4 KB Created: 2021-08-21 17:47:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: ee70f5919778d7ea7df0c7687ac51ba6 SHA-1: 782cccac6750951c1b8c5681b3ef41b21c49f0da SHA-256: 7f30d4089a581659ab822e3edfc37b30dabb2f80c159b25ca112451485f0f66f
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was detected as a malicious PDF by ClamAV, indicating a phishing or trojan payload. It contains embedded JavaScript, which is often used to exploit PDF vulnerabilities or redirect users. The presence of a link farm pointing to multiple distinct hosts, many of which appear to be compromised WordPress sites, further suggests an attempt to distribute malicious content or phish for credentials.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3485

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nuyewrecruitment.com/wp-content/plugins/super-forms/uploads/php/files/efe6992c5e7ff046a04ad8526c50c66d/budun.pdf In PDF document text
    • http://kfbi.ru/content/file/75047545909.pdfIn PDF document text
    • http://adidravidar.com/ckfinder/userfiles/files/dawawilizunupuwif.pdfIn PDF document text
    • http://sincaremedicaltour.com/js/upload/buvebasufobidekepobotax.pdfIn PDF document text
    • https://alignerco.com/wp-content/plugins/super-forms/uploads/php/files/58e924c410ed96dab105559811f7a9bd/figuj.pdfIn PDF document text
    • http://lifestyleufa.ru/wp-content/plugins/super-forms/uploads/php/files/b6991f7aa9bba4ff9bc7e91958a55b5a/wunin.pdfIn PDF document text
    • http://zaun-produzent.de/userfiles/file/87260403631.pdfIn PDF document text
    • http://chinahongji.com/d/files/lesuviwerafelovekutikesa.pdfIn PDF document text
    • http://hoondb.com/wp-content/plugins/formcraft/file-upload/server/content/files/160718779c4380---wedekenebuj.pdfIn PDF document text
    • http://kaplanpm.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071e26aaf85d---24849954144.pdfIn PDF document text
    • https://gresathouse.com/wp-content/plugins/super-forms/uploads/php/files/c04fa84f38e887b52da2bda17d685a48/61328249445.pdfIn PDF document text
    • http://iphysiology.ru/upload/gudogawugitogomimokulafi.pdfIn PDF document text
    • http://podhoru.cz/userfiles/file/75000589247.pdfIn PDF document text
    • http://www.lauricedale.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607fe304e594d---64406322379.pdfIn PDF document text
    • http://cgt-fo-csc.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1609cb9ca107ef---gesiduposafoxujitusatevij.pdfIn PDF document text
    • http://zhouzhuank.com/v15/Upload/file/20216212233467863.pdfIn PDF document text
    • http://keyflounge.nl/userfiles/file/34608387155.pdfIn PDF document text
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/sk17b169c9792nvjv2uslq4er4/31239152403.pdfIn PDF document text
    • http://vizugy.hu/uploads/files/files/50689585755.pdfIn PDF document text
    • https://forexinc.ca/upload/editor/file/76992092009.pdfIn PDF document text
    • https://markyatirim.com/resimler/files/sovijoxazome.pdfIn PDF document text
    • https://akarchlight.com/wp-content/plugins/super-forms/uploads/php/files/d65d6122cb7dfb7672c8d0d85c2092b5/xodomugogugadozumoxu.pdfIn PDF document text
    • http://www.thediethub.in/wp-content/plugins/formcraft/file-upload/server/content/files/16072088310002---wiwogemagoxoviwitukibuv.pdfIn PDF document text
    • https://gruppopolidori.com/upload/image/file/wimefape.pdfIn PDF document text
    • https://www.sharpeningfactory.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a4c06c7cb6---pixabazimabinovunekude.pdfIn PDF document text
    • http://saluteebenesseresas.it/userfiles/files/begedimedusavexab.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/DOqCt-cVA4I/uplcv?utm_term=npv+calculation+example+pmpPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.