Malicious PDF — malware analysis report

Static analysis result for SHA-256 88cbb97c9c8eefc0…

MALICIOUS

PDF

51.6 KB Created: 2021-06-18 15:27:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c5bb8620f779b0155facd73b6838a894 SHA-1: 6ba211e764a4f8e4a66b5250ab120c2ff346066b SHA-256: 88cbb97c9c8eefc08f8f0c195fe98e28cc3cf52f18df436af6add9fd44f17ba3
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF is designed as an image-based lure, typical of phishing campaigns, to trick users into clicking embedded links. These links lead to compromised WordPress sites hosting further malicious PDFs, indicating a multi-stage attack. The ClamAV detection and ML classifier strongly suggest malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7151

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 51 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://videoacceso.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c97e7a5165b---xanuxuwopelevamorusevo.pdf
    • http://brlairport.com/images/file/govawiwodoxuzozajusem.pdf
    • https://amalighting.com/wp-content/plugins/super-forms/uploads/php/files/b816d32fcf33fffd864e19b8f8339812/zokebugit.pdf
    • http://parcfamilyreunion.com/clients/b/b3/b3ae52aef0329bb57e848b27182677c8/File/30985420049.pdf
    • http://www.sunaryem.com.tr/wp-content/plugins/super-forms/uploads/php/files/p0lr6e0hemvmcigvnjjltf7s90/guzej.pdf
    • http://steps4cancer.org/clients/a/a7/a78c374070a178914b502abaf3db82b8/File/34003581508.pdf
    • https://travelworld.ro/userfiles/file/kelover.pdf
    • https://rmissio.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160811e8688009---buriw.pdf
    • https://stcatherine.ac.ug/wp-content/plugins/formcraft/file-upload/server/content/files/16077bc9435a5c---17135695172.pdf
    • http://mtlebanon62.com/clients/5/5e/5ee551a8be14a26d7d76bc5e90dd1372/File/77214177976.pdf
    • https://lesfeesdelhetre.fr/upload/files/96533627823.pdf
    • https://www.emmabowman.com/wp-content/plugins/super-forms/uploads/php/files/15ed33fd06ca3a532cda148f653afa25/24391188274.pdf
    • https://vmkstroi.ru/wp-content/plugins/super-forms/uploads/php/files/05d36d4e50c60e1c86fc1295e62bb8e1/89907202689.pdf
    • https://bevelec.com/bevelec/dossierMois/file/48194784187.pdf
    • http://allaboutdowney.com/userimages/falirasugaw.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=funny+mcpe+skins

Open this report in the interactive analyzer, or submit your own file for analysis.