Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad1758d9570fc73a…

MALICIOUS

PDF

91.5 KB Created: 2021-07-23 14:06:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: c9815ff3375b9681546bd6060e92fb96 SHA-1: 6322905fcee5653b71465c73fd375caf775d403f SHA-256: ad1758d9570fc73a8ad703eb0cc4c7971699f62f05a2f487eef804957a079c09
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The file was detected by ClamAV as Pdf.Phishing.Trojan. It contains multiple links pointing to PDFs hosted on compromised WordPress sites, indicating a likely phishing or malware distribution campaign. The presence of a link farm on a compromised CMS upload storage further supports this assessment.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3533

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://stefandes.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b15286893c9---74292954755.pdf In PDF document text
    • https://www.uniqueartzz.com/wp-content/plugins/super-forms/uploads/php/files/4likloa4nv3a8eiathbe0630ti/91690629153.pdfIn PDF document text
    • http://langeline.com/ckeditor/upload/files/36357270936.pdfIn PDF document text
    • http://mutitar.com/user_img/files/mizesukevaxupuwowukoxig.pdfIn PDF document text
    • https://eternalbliss.net/file/zifaranadakorarobobi.pdfIn PDF document text
    • http://www.a-fairys-choice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c568fd4bcf9---dilunigamiz.pdfIn PDF document text
    • https://hightechrustremovers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160dafa2c25500---37578641373.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/3vuEKuznOb8/uplcv?utm_term=ver+pelicula+completa+el+principe+de+las+mareas+onlinePDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.