Malicious PDF — malware analysis report

Static analysis result for SHA-256 922fad0d78160339…

MALICIOUS

PDF

55.8 KB Created: 2021-05-15 01:44:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d4366a6f9c7d315512913d1f1faec84d SHA-1: 6545cf99eae869f501a6510a00a85def1d0b2079 SHA-256: 922fad0d78160339982a0c96e2aa4be4bda09657d744fab38b021a387cd89839
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many hosted on compromised CMS platforms, suggesting a link farm designed to redirect users. The document body text, though heavily obfuscated, mentions 'Md5 checksum utility', which is likely a lure to disguise the malicious intent. The ClamAV detection and ML classifier further support its malicious nature, indicating it's a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7658

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.olympussverige.se/wp-content/plugins/super-forms/uploads/php/files/hsgrf89ve6ij7h4cve7ll1jve7/5597396212.pdf
    • https://neavocats.com/wp-content/plugins/super-forms/uploads/php/files/33dd0f5ccf16ce77bdbc4e1219a93f64/62573202390.pdf
    • http://xn--80ackbssfuieecff0e8c.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/hm7sju067h12ll7f6le3ajrlu2/25438841617.pdf
    • http://makaifruits.com/wp-content/plugins/formcraft/file-upload/server/content/files/16076263b6212d---9233240142.pdf
    • http://paymentsbusiness.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16084efd682e69---zedotedobewowanogurog.pdf
    • http://svenstavik.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f3e57d1ad5---98599552339.pdf
    • http://mesotects.com/wp-content/plugins/formcraft/file-upload/server/content/files/160848e5fd3fdd---21422903192.pdf
    • http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c9c46cf867---68314414729.pdf
    • https://lightspec.com/wp-content/plugins/super-forms/uploads/php/files/f24b6e873a2a93eae58a2ace057cef6c/zagipasedusilimunusom.pdf
    • https://canvasations.com/wp-content/plugins/super-forms/uploads/php/files/iahjk013q04hg0q2k9e9ni8br2/50149896751.pdf
    • https://dm288.rs/slicice/file/38587351823.pdf
    • http://reiki-roots.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16085a604c5714---bunefewas.pdf
    • http://www.elsecretodelolivo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c5b790f592---nelepuwomagosexoj.pdf
    • http://www.alex-vasilkov.ru/images/wisdom/file/98245594771.pdf
    • https://mercedesmazo.es/wp-content/plugins/formcraft/file-upload/server/content/files/1609da62747881---rojukuvukoxuwagijeritigeb.pdf
    • https://amartzon.store/wp-content/plugins/super-forms/uploads/php/files/c78a8cb52e17b68083e189009ae1b56b/68025082235.pdf
    • https://3dreamstudios.com/wp-content/plugins/super-forms/uploads/php/files/a547d8c798ec298bcdcb3c1505d5b557/xufijuxixatapuvajubev.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/fzgW7-mxBc0/uplcv?utm_term=md5+checksum+utility+v2.+31

Open this report in the interactive analyzer, or submit your own file for analysis.