Malicious PDF — malware analysis report

Static analysis result for SHA-256 9842d949abbf4c44…

MALICIOUS

PDF

58.1 KB Created: 2021-06-14 22:18:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: eab1817314f1727ec14a4b88a0b3db95 SHA-1: bb01693723120c75210af3de287a058c4fd26b5b SHA-256: 9842d949abbf4c4440f0cdcd73064063083bf1d2cb931a3e3831272298e0b678
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is classified as malicious by ML models and ClamAV, indicating it is a phishing or trojan delivery attempt. It contains numerous links to external websites, many hosted on compromised CMS platforms, suggesting a link farm designed to redirect users to malicious content. The document's content, though heavily obfuscated, appears to be a lure related to an 'iPad mini 5 manual'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6893

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/uplcv?utm_term=ipad+mini+5+manual PDF link annotation
    • http://irishheritagesociety.net/clients/7/7f/7f3653e4c5d791bf76f28d2bf9929747/File/23071212046.pdfIn PDF document text
    • https://drainscovers.com/wp-content/plugins/super-forms/uploads/php/files/f93fbdea6d0922f4e75de0f8d6dab208/95532962306.pdfIn PDF document text
    • https://genesisbehaviorcenter.com/wp-content/plugins/super-forms/uploads/php/files/0b496cc374d4a891a2607be3f544b667/74183328261.pdfIn PDF document text
    • http://xboxheerlen.nl/userfiles/file/vuwasekemapiwidojifasow.pdfIn PDF document text
    • http://ophirtonhotel.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1606d8ebe27f0b---8965127726.pdfIn PDF document text
    • http://festivaldeliteraturadepereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a8ec70613ef---jofijoxap.pdfIn PDF document text
    • http://hattrick-sports.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c7101a2353c---pomari.pdfIn PDF document text
    • https://inclinedigital.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ce54dc8491---77709817722.pdfIn PDF document text
    • http://airholic.com/UpFiles/WebEditorFiles/file/65933884972.pdfIn PDF document text
    • http://www.suffaheducation.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609858075409e---refarejuxukotifulidep.pdfIn PDF document text
    • https://mission4recruitment.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e0a9609002---29494192188.pdfIn PDF document text
    • https://n95america.com/wp-content/plugins/super-forms/uploads/php/files/1efbc4d365bccc45f908568892c1e7b0/vopunabapadetu.pdfIn PDF document text
    • https://bobecoingatlan.com/uploads/editor/file/murufapibosedomixoruv.pdfIn PDF document text
    • https://aduanaldelvalle.com/userfiles/file/12932924849.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a3383cd0d66---zaxowamodifumuzojewe.pdfIn PDF document text
    • http://avtoarka.ru/wp-content/plugins/super-forms/uploads/php/files/8865e0f354cc81eea7a8e7043b4d6b6b/jaxureginirabopebaseb.pdfIn PDF document text
    • http://paintingservicesonline.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160c64e40a8e53---32656555343.pdfIn PDF document text
    • http://d4storonto.com/clients/e/ed/ed023a0734c265ca673a92d1d81de675/File/tesexopafupewijetidetujo.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.