Malicious PDF — malware analysis report

Static analysis result for SHA-256 bc8ed81a4c187541…

MALICIOUS

PDF

44.8 KB Created: 2021-06-24 21:30:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 9c51f4491b9b7d1d91738deb850a55a0 SHA-1: 84e85740ddf9e19cf05cabc9a545d19f9b5bc9e6 SHA-256: bc8ed81a4c18754193b64f276a683a378dc5d533f548948e5559431cd438b706
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, directing users to multiple external websites, some hosted on compromised CMS platforms. The primary goal appears to be directing users to potentially malicious or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8552

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cructi.ru/uplcv?utm_term=turnigy+plush+10a+manual PDF link annotation
    • http://duszek-lasu.pl/userfiles/file/74278113223.pdfIn PDF document text
    • http://olsztyntransportmedyczny.pl/userfiles/file/76006996370.pdfIn PDF document text
    • http://cleannshieldflorida.com/wp-content/plugins/super-forms/uploads/php/files/b9699dd5ffff4c18571c494823ee5a6f/95821005138.pdfIn PDF document text
    • http://asu.com.vn/wp-content/plugins/super-forms/uploads/php/files/i9neki64aor8lqgndp7p4u198a/37223693687.pdfIn PDF document text
    • http://trungnguyenjsc.vn/uploads/image/files/lunubalitodul.pdfIn PDF document text
    • http://szentistvanpatika.hu/upload/file/dexidusofumatozusuma.pdfIn PDF document text
    • http://kindervakantieweekdeurne.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160bca07e782a3---jerevawezof.pdfIn PDF document text
    • http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160af8ffb8f0fb---xifetagarogil.pdfIn PDF document text
    • https://xo-sound.ru/userfiles/file/baxubarufutolenomerikoba.pdfIn PDF document text
    • http://botanicgardenscafe.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160c5abfd8ab21---89516355997.pdfIn PDF document text
    • http://reclaimsplus.com/wp-content/plugins/super-forms/uploads/php/files/73909facd7e87a0106c20101b9943d51/79997897047.pdfIn PDF document text
    • https://songhong.info/userfiles/file/12468485078.pdfIn PDF document text
    • https://promocionesnma.com/wp-content/plugins/super-forms/uploads/php/files/8a088a6811f1c8bf9d3382c4c9275f1a/82932447114.pdfIn PDF document text
    • http://www.fattyweng.com.sg/wp-content/plugins/formcraft/file-upload/server/content/files/16094876eb0294---tivabufikazamebuvasirag.pdfIn PDF document text
    • https://freedomhypnosisnyc.com/wp-content/plugins/super-forms/uploads/php/files/14d3f90b4b2dc49c8fd43c6303f219fb/govetu.pdfIn PDF document text
    • http://stolizstekla.ru/userfiles/file/75147641865.pdfIn PDF document text
    • https://www.cfo-search.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d51b19f50c---23686096423.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.