Malicious PDF — malware analysis report

Static analysis result for SHA-256 81933be81799d75c…

MALICIOUS

PDF

54.3 KB Created: 2021-06-05 19:04:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 70a9f415e8aa36321882b2b8a66e267c SHA-1: 521da9ddb93bf9e25fc22b8fe1dcf0554aa91de7 SHA-256: 81933be81799d75c9c2089ac0672a0ce01ceb9069f79a0442b10853d8ec9ff2c
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is designed to deceive users by impersonating university joining instructions. It contains a link farm pointing to various URLs, many hosted on compromised CMS uploads, which likely serve as a distribution point for malicious payloads. The ML classifier also flagged this PDF as malicious, increasing confidence in its malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7284

Heuristics 4

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=mwalimu+nyerere+university+joining+instruction+pdf
    • http://mai-colle.jp/userfiles/file/nuguruxopobenimifon.pdf
    • https://amartzon.store/wp-content/plugins/super-forms/uploads/php/files/1994c83f952c351465dd61d11c495f74/70183662245.pdf
    • https://smithsgame.com/calisma2/files/uploads/reverisujavujapojoluli.pdf
    • https://robinio.de/wp-content/plugins/super-forms/uploads/php/files/v8e52jac4ejtbfb87d25h5pkv9/movopomozopugexiguwepowa.pdf
    • https://vdbergelectro.nl/wp-content/plugins/super-forms/uploads/php/files/e7933028362ec1c41befb9f6b6993053/46366912863.pdf
    • http://vyveva.eu/UserFiles/File/kivesikimipa.pdf
    • http://tillmanfamilyreunion.com/clients/b/b7/b7385abc5988d1ee605fea7695e3d00e/File/kitixibufiwazokipiz.pdf
    • https://specialbrands.gr/wp-content/plugins/super-forms/uploads/php/files/ae304f2ac2de3f3ab8b3d415ff46fc69/34610568990.pdf
    • https://www.pharmaright.ca/wp-content/plugins/super-forms/uploads/php/files/st0bobgvrkdb2jtbkt1br0t5fl/kijarofimebe.pdf
    • http://miamiwars.pl/wp-content/plugins/super-forms/uploads/php/files/938114f9a432570f36123dcef9029f3d/52184690098.pdf
    • http://tnslib.net/userfiles/files/27284448956.pdf
    • http://www.stratcareerservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a04cfa0708d---vumomanejufebodalebefeg.pdf
    • http://www.cuadernos.in/wp-content/plugins/formcraft/file-upload/server/content/files/1609ca941191e8---85182994794.pdf
    • https://www.anandtirth.com/wp-content/plugins/super-forms/uploads/php/files/7fc2tm6g5vht82dctlgjakq554/visidaneg.pdf
    • https://augsburger-dartliga.de/uploads/file/90196807668.pdf
    • http://ty-universe.com/image/files/20210530_104344.pdf
    • https://bistro-8.com/wp-content/plugins/super-forms/uploads/php/files/c31875a94700b88e50776e5c13822e44/fumibupinetup.pdf