Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab041043a1d1253e…

MALICIOUS

PDF

50.9 KB Created: 2021-09-07 09:56:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 7866ee4638bc0da5480380edbdbe117e SHA-1: a994a291fc3a93aea0e26cf64bb5b7fd92c07af4 SHA-256: ab041043a1d1253ee2d001beb86e501933f1654bc166e71e72858520282619a6
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and ML classifiers, indicating a phishing or trojan threat. It contains numerous links to external websites, many hosted on compromised WordPress installations, suggesting a link farm designed to redirect users to malicious content. The document body is heavily obfuscated and appears to be generated by wkhtmltopdf, further obscuring its true intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6678

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/uplcv?utm_term=cae+exam+maximiser+pdf
    • https://lostsoulsmemorialnj.org/wp-content/plugins/super-forms/uploads/php/files/f94eba97c80c2b42ec7b1aff08f5bcab/72127940011.pdf
    • http://gilbertthomasreunion.com/clients/5/5f/5f56fe696be94dde62972871c8a9bc28/File/73206190374.pdf
    • https://psfund.org/public/uploads/files/cms_files/22946827806.pdf
    • https://brusroom.com/wp-content/plugins/super-forms/uploads/php/files/ee18d0b3c6601dab2f620c5674ed53a5/mufikuzolajalenor.pdf
    • https://quatcongnghieput.com/uploads/files/xexom.pdf
    • https://infravoip.com/wp-content/plugins/super-forms/uploads/php/files/85be0ed898876e863c6aa13c41d3e961/34896208055.pdf
    • http://vladekoservis.ru/files/46155308661.pdf
    • http://isvpro.com/custom/files/64735935126.pdf
    • http://0-50.ru/userfiles/file/mexosuwukatexule.pdf
    • https://chingchia.com/uploads/files/202108260646534681.pdf
    • http://eduomania.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bad4d19c497---91824204589.pdf
    • https://www.dolphinrfid.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e168466fc00---bezivinazizomuz.pdf
    • https://ikuseikyokai.jp/ckmedia//files/potefasoleviwewaru.pdf
    • https://intelean.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a80d0552321---folotobuweratub.pdf
    • http://zonazero.es/userfiles/file/vuvilesulip.pdf
    • http://www.dj-csnl.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1609b743d7d8ad---85646290379.pdf
    • http://mulherinscampground.com/clients/879992/File/ganiwokukino.pdf
    • https://home18.ru/wp-content/plugins/super-forms/uploads/php/files/faa348754258c3378c83e05a05b5b658/lelibasokesegedex.pdf
    • http://www.advokat.com/app/webroot/img/fck/file/zubivakegur.pdf
    • https://afriqueitnews.com/wp-content/plugins/super-forms/uploads/php/files/4aea52534dfcf299e015f634910876a2/84038795241.pdf
    • http://pulsrmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d5a934a93b---goxuvazamavosiwejutol.pdf
    • http://www.videobezopasnost.ru/ckfinder/userfiles/files/88955462575.pdf
    • http://sushrutproctology.org/ckfinder/userfiles/files/37950426663.pdf
    • https://nangluongvada.com/uploads/files/85294905306.pdf
    • https://icbacademy.com/upload/files/bekomisexefo.pdf
    • http://skrabl.pl/www/rpbd/fck/file/56569910574.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.