Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac6eb9cba6b6dd85…

MALICIOUS

PDF

48.0 KB Created: 2021-10-05 13:46:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: 1bb1addb0e9aa6500b04797f2db8bd91 SHA-1: c3c5b9bc7b65fea45cfcef6d37ff9f328d4dec07 SHA-256: ac6eb9cba6b6dd8574b291fd58b91f05687d536b9a3b9ab6320fbe5fc092b4a9
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and a significant number of external links, many hosted on compromised CMS platforms. These links appear to be part of a link farm designed to redirect users to download sites, likely for unwanted software or malware. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8005

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oniceh.ru/uplcv?utm_term=filmora9+video+editor+for+pc+free+download PDF link annotation
    • https://gbp.dropship-online.com/userfiles/files/60929155220.pdfIn PDF document text
    • http://ilovechardonnayhills.com/userimages/80588702711.pdfIn PDF document text
    • http://www.mondzorgvesa-voorschoten.nl/wp-content/plugins/formcraft/file-upload/server/content/files/161380d7d69242---sabofudu.pdfIn PDF document text
    • http://3e3i.com/UserFiles/file///xawakologupeji.pdfIn PDF document text
    • http://gaishachuukobuhin.com/js/upload/files/95564910594.pdfIn PDF document text
    • https://copyjokertw.aw6.tw/uploadfile/qu4_qu106_com/files/17483704773.pdfIn PDF document text
    • https://maharajganjtimes.com/assets/ckfinder/core/connector/php/uploads/files/dumefirujumupakija.pdfIn PDF document text
    • http://longchimvac.net/app/webroot/uploads/files/53288530765.pdfIn PDF document text
    • http://awarelaxcentrum.cz/user_files/file/93159552800.pdfIn PDF document text
    • http://smolensk-bakaleya.ru/userfiles/file/zanorapunafasu.pdfIn PDF document text
    • http://asv-solnice.cz/_files/file/6624836022.pdfIn PDF document text
    • http://europeanprofservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615a61acc183b---61632333146.pdfIn PDF document text
    • http://www.juniorcollege.cl/ckfinder/userfiles/files/jimafekilabujuvonofijige.pdfIn PDF document text
    • http://fsgpj.com/upfolder/e/files/20210921200826.pdfIn PDF document text
    • http://laptopcuhaiphong.vn/upload/files/81631218446.pdfIn PDF document text
    • http://www.loockuniformes.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/1615a8210f1307---gililivubusobakan.pdfIn PDF document text
    • http://www.realisthotel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614d60d1aa0dc---37611613770.pdfIn PDF document text
    • http://sicilyontable.it/userfiles/files/punezam.pdfIn PDF document text
    • http://humanlitech.com/files/files/58130052452.pdfIn PDF document text
    • http://luckysim.com/userfiles/file/85230496071.pdfIn PDF document text
    • http://lerucherdesanges.fr/userfiles/file/tejukolozadevubi.pdfIn PDF document text
    • https://anbc31.iscriptscloud.com/app/webroot/files/file/soparo.pdfIn PDF document text
    • https://anukulagrotech.com/ci/userfiles/files/lamarekudubogox.pdfIn PDF document text
    • http://keyflounge.nl/userfiles/file/26944644227.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.