Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d2f113979d9dd15…

MALICIOUS

PDF

64.0 KB Created: 2021-09-07 05:08:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 7c97c98eb6cb1fd3ee053c58b08d68f4 SHA-1: 29e34560c60cb2446392d8737b114666395b6d46 SHA-256: 9d2f113979d9dd15e22af9a53370df3384848acb83bb80c4d6b663afdeed5260
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and contains embedded JavaScript, indicating an attempt to execute code. It also features a link farm pointing to compromised WordPress uploads and disposable hosting, suggesting a phishing or malware distribution scheme. The embedded JavaScript likely facilitates the redirection to malicious sites or the download of further payloads.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4667

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://travelci.ru/ckfinder/userfiles/files/26972856834.pdf In PDF document text
    • http://lirealestatelitigator.com/wp-content/plugins/super-forms/uploads/php/files/c019d6572bcb211e924f75c3b855f6a9/buteza.pdfIn PDF document text
    • https://alternativecarrepair.com/userfiles/file/sexodigix.pdfIn PDF document text
    • https://alshaabcoop.com/userfiles/file/xozexuvatatidof.pdfIn PDF document text
    • http://emrc.ie/upload/imagecontent/file/79913743810.pdfIn PDF document text
    • https://krono-original.vn/Images_upload/files/pujude.pdfIn PDF document text
    • http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/160983032854f5---mirezosum.pdfIn PDF document text
    • https://braintreeclinics.com/app/webroot/img/files/2813008163.pdfIn PDF document text
    • http://thailaundry.com/imgUpload/files/84909472009.pdfIn PDF document text
    • http://boldogelet.hu/media/57425195768.pdfIn PDF document text
    • http://chinhsuasolieu.com/media/files/guvoje.pdfIn PDF document text
    • http://vtracauto.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b5eab475271---butowizajuremejikevepod.pdfIn PDF document text
    • http://teifsepahan.com/files/file/lesoxolod.pdfIn PDF document text
    • http://sazjah.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c2f5a55ee8---44562810592.pdfIn PDF document text
    • http://mikailang.net/userfiles/file/20210621043810_809137660.pdfIn PDF document text
    • https://cortopolis.ar/userfiles/file/70754878491.pdfIn PDF document text
    • http://hzkontejnery.cz/ckfinder/userfiles/files/12588000696.pdfIn PDF document text
    • http://johndanton.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/14095725256.pdfIn PDF document text
    • http://xn--90ad5ackt1d.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/2d79578e7a42319d237d53033395f6a9/65515147275.pdfIn PDF document text
    • https://velvetskin.pl/wp-content/plugins/super-forms/uploads/php/files/d61b96f9fb46baf2431ba006814f0ce2/66105674837.pdfIn PDF document text
    • http://orlickachata.cz/files/files/lugokusajuribidisul.pdfIn PDF document text
    • http://speed-r.com/js/upload/files/99024025204.pdfIn PDF document text
    • https://varbackaforskola.se/ckfinder/userfiles/files/24329051280.pdfIn PDF document text
    • https://stijsr.com/userfiles/file/80617178632.pdfIn PDF document text
    • http://kiiga.ru/userfiles/file/33960024723.pdfIn PDF document text
    • https://www.nordatec.com/wp-content/plugins/super-forms/uploads/php/files/gdtljvj96c16q3jtseqookinqb/jegoxurepi.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/cv9VXjIrmdE/uplcv?utm_term=how+to+convert+a+pdf+document+into+a+powerpoint+presentationPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.