Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c5830ab33a060bc…

MALICIOUS

PDF

59.5 KB Created: 2021-07-20 10:12:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-31
MD5: e290c08500102cd6f8293aa37c35c494 SHA-1: 46923b29e7996e18f1f6203a32c62a753c836423 SHA-256: 9c5830ab33a060bc78b1c35619488a17e9d8b3c688d6b9aa3d784cd0b2994036
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it functions as a link farm, with numerous URLs pointing to compromised WordPress upload directories. These links likely serve as a distribution mechanism for further malicious content or phishing attempts.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5422

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.etbsupplies.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a2f1f885853---tudurojegakoporasa.pdf In PDF document text
    • http://www.danvillern.com/wp-content/plugins/super-forms/uploads/php/files/2j82e6m0r3ibvrlgbnglj8o6t5/40637051401.pdfIn PDF document text
    • https://puertoestereo.com/wp-content/plugins/super-forms/uploads/php/files/7fvqvklnis9s2i4lpgo8lrmdmq/37710456953.pdfIn PDF document text
    • http://solar-makernavi.com/ckfinder/userfiles/files/34083776168.pdfIn PDF document text
    • https://nicemexico.net/wp-content/plugins/formcraft/file-upload/server/content/files/160756b78eddb6---40699331404.pdfIn PDF document text
    • https://semagro-msw.ru/pics/images/file/kuvexuwo.pdfIn PDF document text
    • http://quangcaosms.org/media/ftp/file/xugazududowemetevugevapu.pdfIn PDF document text
    • https://marciasmithconsulting.com/wp-content/plugins/super-forms/uploads/php/files/c23830ffeee6751dfccea8c396037f8f/tudasidutinukalu.pdfIn PDF document text
    • https://iveducentar.com/uploads/assets/file/8087084541.pdfIn PDF document text
    • http://ophtalmic-overnight.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160748af135ee2---72063338046.pdfIn PDF document text
    • http://drvision.org/wp-content/plugins/formcraft/file-upload/server/content/files/16070cc7340242---lolutifixofedabe.pdfIn PDF document text
    • https://www.vedaaz.com/wp-content/plugins/super-forms/uploads/php/files/aa62a76d2f2d75cf0fc755989a9da46b/24599437231.pdfIn PDF document text
    • http://hoondb.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077ad37d485e---33370925615.pdfIn PDF document text
    • http://isemya.by/modules/ariol/static/ariol/ckfinder/files/10895582765.pdfIn PDF document text
    • http://miwon.com.vn/app/webroot/uploads/files/90693264382.pdfIn PDF document text
    • http://nuyewpilot.academy/wp-content/plugins/super-forms/uploads/php/files/8e591045a42464a597850305f9b37acd/valojepunozizomukupipek.pdfIn PDF document text
    • https://vmkstroi.ru/wp-content/plugins/super-forms/uploads/php/files/becc8a8bb950033bcb2c5b94dc676a2d/48883215114.pdfIn PDF document text
    • https://frontiersneurophotonics.org/wp-content/plugins/formcraft/file-upload/server/content/files/1/16098403917a08---dafidopifurukived.pdfIn PDF document text
    • https://flycam.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160812c37332c9---66110623610.pdfIn PDF document text
    • https://bettenbaehren.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a54ee795a19---vuvobo.pdfIn PDF document text
    • https://sellerflows.com/wp-content/plugins/super-forms/uploads/php/files/be002925a9aadece427e11c59fd386fd/bapavepedumunibaxaxetejen.pdfIn PDF document text
    • https://electrodomesticaruano.com/images/ckfinder/files/zetomez.pdfIn PDF document text
    • http://interface-referencement.com/userfiles/file/42588009922.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/1KS0DP0cxss/uplcv?utm_term=practice+b+exponential+functions+growth+and+decayPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.