Malicious PDF — malware analysis report

Static analysis result for SHA-256 a63e20431bb96d10…

MALICIOUS

PDF

47.7 KB Created: 2021-09-17 01:59:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12
MD5: b0a2b9c8033142bad16ff54895e2ef63 SHA-1: 6d149f42f6509663a5a9fb59f40262cf4596035b SHA-256: a63e20431bb96d1076a7aab8295a5f8cc86ef5b9b0e040029af271e70fd565dd
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document identified as malicious by ClamAV and an ML classifier. It contains numerous embedded URLs, many pointing to compromised WordPress upload directories, suggesting a phishing or malware distribution scheme. The presence of external URIs and link farms indicates an attempt to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7355

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/uplcv?utm_term=square+root+function+calculator PDF link annotation
    • http://www.luminicaambiental.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613bc713231da---sodoxabojawunur.pdfIn PDF document text
    • https://pyhm.ca/wp-content/plugins/super-forms/uploads/php/files/4rh3oq2t1s2jac9ibvkkbol8gm/dijetomutijafisoga.pdfIn PDF document text
    • https://psychotherapie-dr-albrecht.de/wp-content/plugins/formcraft/file-upload/server/content/files/1613aa83f3ea62---widipevowopaj.pdfIn PDF document text
    • http://dade666.com/userfiles/202109file/2021090211582170554.pdfIn PDF document text
    • http://prospekt-rostov.ru/ckfinder/userfiles/files/13351505655.pdfIn PDF document text
    • http://doctour.hu/uploads/ckfinder/userfiles/files/53312254341.pdfIn PDF document text
    • https://schreinerheusi.de/wp-content/plugins/formcraft/file-upload/server/content/files/16138b0de17422---10640357733.pdfIn PDF document text
    • http://schouteninterieurwerk.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1613c970a468f6---49778160159.pdfIn PDF document text
    • http://pileshoppen.dk/userfiles/file/67732348155.pdfIn PDF document text
    • http://odnoklassniki-files.ru/images/uploads/files/sapelatibijepisudave.pdfIn PDF document text
    • https://mystruggle.uk/indigo/ckfinder/userfiles/files/zasozerurazojalonojisun.pdfIn PDF document text
    • http://kaies.net/upfiles/210908074205056619m3xirx.pdfIn PDF document text
    • http://festivaldeliteraturadepereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/16142c28f0f27e---paxagawufabasikibaberuliw.pdfIn PDF document text
    • http://ecole-belair.com/ecole/file/fodamigejofu.pdfIn PDF document text
    • https://hotararicedo.ro/files/files/luwonixikome.pdfIn PDF document text
    • http://namlinhchivietnam.net/userfiles/image/file/14446064291.pdfIn PDF document text
    • http://ccsilver.kr/files/fckeditor/file/13128512096131a52e82c7a.pdfIn PDF document text
    • https://springkasteelhuren.be/userfiles/file/tanabazenizisim.pdfIn PDF document text
    • https://lsp.od.ua/wp-content/plugins/super-forms/uploads/php/files/m61hukc973e6k18hubsq4bskl2/15078140466.pdfIn PDF document text
    • https://ckv-siemreap.org/ckfinder/userfiles/files/70242159068.pdfIn PDF document text
    • https://hk-delight.com/UploadFiles/file/53999100407.pdfIn PDF document text
    • https://www.3dreamchurch.com/wp-content/plugins/super-forms/uploads/php/files/c6199d51256425f60d5f65bde5225918/2300730697.pdfIn PDF document text
    • http://dominant.name/userfiles/file/kizimeripapejijikebepo.pdfIn PDF document text
    • https://samavetpharm.com/userfiles/files/rufesaguzup.pdfIn PDF document text
    • http://agataklimowska.pl/userfiles/file/xefelexoxavukuju.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.