Malicious PDF — malware analysis report

Static analysis result for SHA-256 993da0a9f8237433…

MALICIOUS

PDF

80.0 KB Created: 2021-07-07 04:25:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 685e86108beca84be370d204eed81684 SHA-1: 6578e765a93ef335475f525304f3817f65b81459 SHA-256: 993da0a9f82374335ecf790c48c0fed5f294b92281bf4154ec8415197a82cb5f
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file is identified as malicious by ClamAV, specifically as a phishing trojan. Static analysis reveals it functions as a link farm, containing numerous URLs pointing to various websites, some of which are hosted on compromised WordPress installations or disposable domains. The presence of 'utm_term' parameters in some URLs suggests an attempt to track user engagement, common in phishing campaigns.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4833

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garglob.ru/uplcv?utm_term=what+does+sample+proportion+mean
    • https://washlounge.in/ckfinder/userfiles/files/livezowoke.pdf
    • http://zonazero.es/userfiles/file/47709104439.pdf
    • https://aliencosmicexpo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b6b9a9de08e---99846620197.pdf
    • http://mdbim.pl/ubezpiecz/obrazy/file/74577832303.pdf
    • https://phase1acoustics.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b7ac021fc66---xurapokola.pdf
    • http://www.esthemed.ch/wp-content/plugins/formcraft/file-upload/server/content/files/160864fb613142---gedosexakabavanu.pdf
    • https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/8bee10429293817d77b5d9edd77d5d6f/20785537033.pdf
    • https://www.beadvised.co.uk/wp-content/plugins/super-forms/uploads/php/files/ad30995684b22f84750fb0ffaaac8f75/puder.pdf
    • http://nc2e.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160ac3bf1f2ff2---96755360277.pdf
    • http://shtaket46.ru/page_edit/_samples/userfiles/files/butozibirajet.pdf
    • https://www.advids.co/wp-content/plugins/formcraft/file-upload/server/content/files/160d22d45f1e2f---widexamiteroje.pdf
    • http://www.cascinasorigherio.it/wp-content/plugins/formcraft/file-upload/server/content/files/1608de6359f43a---pijarizokawola.pdf
    • http://brownmahonefamilyreunion2015.com/clients/7/71/71b8b7811cafefaf2288418346dc0658/File/livesotidojutaselat.pdf
    • http://elise.pe/images/file/timefobenipifiligafexenom.pdf
    • http://stalmont.eu/userfiles/file/1528808892.pdf
    • http://oodow.cn/upload/file/210705050853099016d4764yercv9c.pdf
    • https://www.nestroots.com/wp-content/plugins/super-forms/uploads/php/files/iaotfkd5l442i9npkhc2cbn5j3/1556069938.pdf
    • https://monarchwinemerchants.com/wp-content/plugins/super-forms/uploads/php/files/0749317298200530cffb34a5aed11b84/92569920182.pdf
    • http://kindervakantieweekdeurne.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c9156f93f9d---72437258550.pdf
    • https://oknoplus-omsk.ru/wp-content/plugins/super-forms/uploads/php/files/ec9ec4095e19e092762a16e9d62533fe/bevonulepi.pdf
    • https://dacoma.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160901d03e3610---1796922499.pdf
    • http://iwish-cosmetics.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bf4dcf49ee7---48481096568.pdf
    • http://www.reenactmentmarket.eu/images/wyswig_images/file/vuxesojeduduf.pdf
    • http://altinay-law.com/images/file/rukivokukesunafimag.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.