Malicious PDF — malware analysis report

Static analysis result for SHA-256 85425de8ba23919c…

MALICIOUS

PDF

64.0 KB Created: 2021-05-25 07:01:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d8c2297e91c6983ef7abaea8253be58f SHA-1: ae1c6bb0238a31424a2847b39ad59fb85b696155 SHA-256: 85425de8ba23919c6188fec3207a3c1bdd95035d70cc56ad8f345a4e64b5e532
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links to compromised websites, many of which are hosted on disposable domains and appear to be part of a link farm. The ClamAV detection and ML classifier strongly indicate malicious intent, likely for phishing or malware distribution. The document body, though heavily obfuscated, suggests a lure related to pet care, which is then redirected to these malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7728

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=how+often+should+i+feed+my+border+collie+puppy
    • https://www.democratum.com/wp-content/plugins/super-forms/uploads/php/files/242fac7ddd5198c236f9aa06694e1578/89850498420.pdf
    • http://www.vitrierbxl.be/wp-content/plugins/formcraft/file-upload/server/content/files/1607027bd16310---tasonapugabapodow.pdf
    • https://lakecountyoralsurgery.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609db700d493a---58245998359.pdf
    • http://springswellness.net/wp-content/plugins/formcraft/file-upload/server/content/files/16081661a59318---86799796868.pdf
    • http://www.barankayalar.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1609788e352787---53006622692.pdf
    • http://www.hkwebdesign.com.hk/wp-content/plugins/formcraft/file-upload/server/content/files/160a339cfe1b02---3086398930.pdf
    • https://singaporenotarypublic.com/wp-content/plugins/super-forms/uploads/php/files/22e6949d15018702fcfbb5f4a5e455dc/bowibajanipevarok.pdf
    • https://www.edutechusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609830d3bebdc---dupofetopiradezivuxase.pdf
    • https://www.peeryhotel.com/wp-content/plugins/super-forms/uploads/php/files/9246e723df473f0705aeba83add4c2d0/17490330177.pdf
    • http://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/a4adfe0b2eecb1f5cc1caa72e64e7316/54190004218.pdf
    • https://alphacleanwashing.com/wp-content/plugins/super-forms/uploads/php/files/99ebb2e9dcb3c010c79bdde91965b250/57918729709.pdf
    • http://www.jcca.co.in/wp-content/plugins/formcraft/file-upload/server/content/files/1607039f57947d---64500070758.pdf
    • http://yatros.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607b4ad5ee190---98496499120.pdf
    • https://boldvision.tv/wp-content/plugins/formcraft/file-upload/server/content/files/160984c543183a---45758492894.pdf
    • https://cspdental.com/wp-content/plugins/super-forms/uploads/php/files/778124118c28d2b331e930db63bbdb5c/33124585804.pdf
    • http://www.northeastmarquees.com/wp-content/plugins/super-forms/uploads/php/files/09d9521768b28654e66cb609ebab9181/73187988443.pdf
    • https://www.isgs.org/wp-content/plugins/super-forms/uploads/php/files/da19f19183eaf5462b117bf3b84d37b1/38071831928.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.