Malicious PDF — malware analysis report

Static analysis result for SHA-256 a815fcd5b851f71e…

MALICIOUS

PDF

69.2 KB Created: 2021-08-07 19:08:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-23
MD5: 47560dbb11226b6a4077bcf5bcc1e762 SHA-1: ba93cecb9620ba3dcbb12194f7d24b4a74e58b40 SHA-256: a815fcd5b851f71e604352ba2c7f142f47ec05003c29b9d0680880b2e75c774b
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous links to external websites, many hosted on compromised WordPress installations, suggesting a link farm designed to redirect users to malicious content. The presence of embedded URLs and the overall structure point towards an attempt to exploit users through deceptive links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5802

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pocatellocampfire.com/wp-content/plugins/super-forms/uploads/php/files/mnfr1b807p8mc1sroep1f4nag0/tafikegupet.pdf In PDF document text
    • http://nek.ua/wp-content/plugins/formcraft/file-upload/server/content/files/16096afd752706---deveximujonukepagozigup.pdfIn PDF document text
    • http://xn--12cfu9bc1efac9a9azfdsb7b9d1f0j.net/ckfinder/userfiles/files/11308387968.pdfIn PDF document text
    • http://omniatel.it/wp-content/plugins/formcraft/file-upload/server/content/files/1609ce41e0b108---nujupizutak.pdfIn PDF document text
    • http://autobedrijvenindex.nl/images/uploads/48210159280.pdfIn PDF document text
    • https://kham.vn/userfiles/file/29701641454.pdfIn PDF document text
    • http://twfbs.com/ckfinder/userfiles/files/55710431362.pdfIn PDF document text
    • http://sahamit.net/userfiles/file/13973558916.pdfIn PDF document text
    • http://thetestmag.com/userfiles/files/tazediziw.pdfIn PDF document text
    • https://rubyyadav.com/nbloom/fckuploads/file/70856018576.pdfIn PDF document text
    • http://www.lifestaralberta.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607553b5d92ee---gekupo.pdfIn PDF document text
    • http://www.kickcommerce.com/userfiles/file/90038822823.pdfIn PDF document text
    • http://haphadoor.com/upload/files/78609268563.pdfIn PDF document text
    • http://haenuri.net/ckupload/files/14734386017.pdfIn PDF document text
    • http://www.kliningstroy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160949c7678741---20314583122.pdfIn PDF document text
    • http://centonze-vini.com/userfiles/files/17977176178.pdfIn PDF document text
    • https://spectrumohio.com/wp-content/plugins/super-forms/uploads/php/files/1fd5dabe7e6f5276c52283c623dddda7/27945931089.pdfIn PDF document text
    • https://fietenhaardenenkachels.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160ad8dc24c389---divapugexelol.pdfIn PDF document text
    • https://grafitpoint.ru/wp-content/plugins/super-forms/uploads/php/files/3db91db84e385e964056363f463b2b52/72014675403.pdfIn PDF document text
    • https://perleyparish.org/wp-content/plugins/super-forms/uploads/php/files/fee0d11a0d15d72b18f186dd5f59717d/36013659567.pdfIn PDF document text
    • http://www.ville-dammarie.com/ckfinder/userfiles/files/luvalopajoravubavima.pdfIn PDF document text
    • http://www.absolutecateringla.com/wp-content/plugins/formcraft/file-upload/server/content/files/160805f07bd02f---xawubijeso.pdfIn PDF document text
    • http://greatnice.club/updatefiles/file/ziwafelunuwarix.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/6naE_Nh8_CY/uplcv?utm_term=discord+bot+send+message+to+channel+jsPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.