Malicious PDF — malware analysis report

Static analysis result for SHA-256 b048a2e4c91b370a…

MALICIOUS

PDF

64.0 KB Created: 2021-05-09 06:22:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3c1c0ba378d210b96ab93e5cba799a49 SHA-1: c5a9a97d5b105482eb1c90e88064a378194e9faa SHA-256: b048a2e4c91b370aaab60d495aae352822a2791985465f867d79140aea64b3ff
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a link farm pointing to multiple compromised WordPress sites, which likely serve as a distribution point for further malicious content. The presence of numerous external URIs and the 'link farm' heuristic strongly suggest a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7605

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=malayalam+kambi+kathakal+audio
    • https://wacee.net/wp-content/plugins/formcraft/file-upload/server/content/files/160702cbf881b4---93853718297.pdf
    • https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/n0p4vfjaefi6vejd67mlg1kttg/ruzed.pdf
    • https://eatorhours.org/e-bussiness/fckimages/file/96125602551.pdf
    • http://www.tenniscanberra.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160774a916c84a---kezopivoxuwinizuse.pdf
    • https://nobleanimalsanctuary.org/wp-content/plugins/super-forms/uploads/php/files/tmp/zurikes.pdf
    • http://plusbateria.com/wp-content/plugins/formcraft/file-upload/server/content/files/160916c17122b5---lekesawulila.pdf
    • https://dbjadow.pl/attachments/file/41654692183.pdf
    • https://deconkhoemanh.com/wp-content/plugins/super-forms/uploads/php/files/qkrarvtd57mtba407bj2lgoa0f/5494993844.pdf
    • http://www.assignproject.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f7122412e3---mixifutamababifusobikej.pdf
    • https://vaytieudungtragop.com.vn/wp-content/plugins/super-forms/uploads/php/files/urbi97tbict0bssf3vosjsif26/rafamerezikisekexav.pdf
    • https://www.andimoda.com/wp-content/plugins/super-forms/uploads/php/files/6ebe749f71f43dc11ff39c6d320e4aba/98417299767.pdf
    • http://www.cargeacrew.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607500cf9a392---refinutenuti.pdf
    • http://alphasigmaoverseas.com/userfiles/file/43346726266.pdf
    • http://es-umzuege-transporte.de/wp-content/plugins/super-forms/uploads/php/files/f25cef0e64825e342d10442234c8562a/bamupewofasurenuvijunubul.pdf
    • http://www.segurosfacility.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160701255aa994---94965980321.pdf
    • https://sip7.pl/autoinstalator/sip7.online/wp-content/plugins/super-forms/uploads/php/files/355d190f1b4a22db0c6d2aa92cdeee7f/doziveb.pdf
    • https://susta.vn/userfiles/file/bafube.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.