Malicious PDF — malware analysis report

Static analysis result for SHA-256 9981eb46eb3e31dc…

MALICIOUS

PDF

175.6 KB Created: 2021-06-10 01:57:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 714facf06a09949de2b710b1a3c69a98 SHA-1: 11639b4edeb50c23f48d3c62604b1977f1e147e3 SHA-256: 9981eb46eb3e31dc3b60b5eed50ec6d508d61d934ce53d1b7ee8d70c04e21dca
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links, many pointing to compromised WordPress upload directories, suggesting it functions as a link farm to distribute phishing or malware. The presence of external URIs and a link farm on disposable hosting further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8961

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ketchas.ru/uplcv?utm_term=munna+michael+english+subtitles+full+movie PDF link annotation
    • https://www.histoiresdegroupes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606fd25090b23---xaxafigakelamogesuba.pdfIn PDF document text
    • http://smithmurdock.com/wp-content/plugins/formcraft/file-upload/server/content/files/160beefdee08e1---43853115500.pdfIn PDF document text
    • https://afanasyev-design.ru/wp-content/plugins/super-forms/uploads/php/files/45b6b972aac14d88cc70e27d8a7551f5/7004385877.pdfIn PDF document text
    • http://vita24h.com/uploads/userfiles/file/kemedupufisidexofedumodo.pdfIn PDF document text
    • http://kaplanpm.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a3e0848ebdc---povasuruxebur.pdfIn PDF document text
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/j4ejj3j9hedje8e0t1ta2l6693/bovugoxudivanumaxete.pdfIn PDF document text
    • http://badischer-kunstverein.de/ckfinder/userfiles/files/luvizovuxerota.pdfIn PDF document text
    • https://www.dentaltaxpros.com/wp-content/plugins/super-forms/uploads/php/files/50bd8e44530335908d362225ad38a924/jopukukaduduzibizidigako.pdfIn PDF document text
    • https://www.criteriainvest.com.br/wp-content/plugins/super-forms/uploads/php/files/b71knhn48guolhfpinqgq53hbe/49565005026.pdfIn PDF document text
    • https://legacydockandmarine.com/wp-content/plugins/super-forms/uploads/php/files/7974469899296e0d4f4ac1e5b7d0f396/62916006462.pdfIn PDF document text
    • http://www.aqsclimited.com/EditorImages/file/92917899296.pdfIn PDF document text
    • http://lifestyleufa.ru/wp-content/plugins/super-forms/uploads/php/files/05067342540311124325e4a12cdd01c4/notaxada.pdfIn PDF document text
    • https://akarchlight.com/wp-content/plugins/super-forms/uploads/php/files/3e4488b3d203bdb5a3db39b452a962a9/16755871519.pdfIn PDF document text
    • http://profisystem.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1608a1a1c1e2dd---firewirituvetisevi.pdfIn PDF document text
    • https://coolingrealestate.com/your-home-cleaner/FCKuploads/file/pumatuduva.pdfIn PDF document text
    • https://controlcert.se/wp-content/plugins/formcraft/file-upload/server/content/files/160a8d2476aa36---32299894366.pdfIn PDF document text
    • http://www.ambredore.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608d2b74138b2---10267800369.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.