Malicious PDF — malware analysis report

Static analysis result for SHA-256 c164742c56174c29…

MALICIOUS

PDF

57.2 KB Created: 2021-07-17 08:30:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-17
MD5: d5d43d6de6826d28199cab041a8e8b0a SHA-1: 46a0dbea74425b33723cb08ed1746f8e7f50c77c SHA-256: c164742c56174c295ceb4c5215756c3001ac41f55706926337f91d23a3d78713
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded URLs, many of which point to compromised websites or disposable hosting, suggesting a link farm designed to redirect users to malicious content. The ClamAV detection and ML classifier further support its malicious nature, classifying it as a phishing trojan. The presence of multiple links to potentially compromised CMS upload directories indicates a tactic to host or distribute malicious files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5388

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nsdadventist.org/FCKData/file/geluwuse.pdf In PDF document text
    • http://chipmax.in/chipmax/ckfinder/userfiles/files/lopujex.pdfIn PDF document text
    • http://cobe-ing.it/userfiles/files/govitolemaluf.pdfIn PDF document text
    • https://art4you.sk/editor_uploads/system/files/38571336403.pdfIn PDF document text
    • http://magogaralbamoble.com/galeria/files/vigulosurew.pdfIn PDF document text
    • https://fastcomputer.vn/wp-content/plugins/super-forms/uploads/php/files/308c4c461dfcef25c1853f1575f8f74a/xelibi.pdfIn PDF document text
    • https://alphacleanwashing.com/wp-content/plugins/super-forms/uploads/php/files/8178d1cab65423a34513ae5e2add0c7a/luvotumogara.pdfIn PDF document text
    • http://palyavalaszto.hu/teszt/upload/file/zisolanolofamon.pdfIn PDF document text
    • http://aaaexpressac.com/userfiles/file/2167478528.pdfIn PDF document text
    • http://interel-rus.ru/test/sites/default/files/file/96403190157.pdfIn PDF document text
    • https://perleyparish.org/wp-content/plugins/super-forms/uploads/php/files/82168fb60aa59458e08fc5833155e2e4/nepapubazenififoj.pdfIn PDF document text
    • https://donnasalon.ru/wp-content/plugins/super-forms/uploads/php/files/3ce0621b3995a933e62eecfa2579e03d/73932943563.pdfIn PDF document text
    • https://www.lorenzofranzone.it/wp-content/plugins/super-forms/uploads/php/files/486f6d397d0c72eb54aed2cf5f9972cb/mamuvotaketove.pdfIn PDF document text
    • http://www.immiflex.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f355ac70f8---zefelirenadesig.pdfIn PDF document text
    • https://action-roofing.com/wp-content/plugins/super-forms/uploads/php/files/eb8e798e589c1bafc6f19b3503a5192f/20529753354.pdfIn PDF document text
    • https://www.lindopoint.it/wp-content/plugins/super-forms/uploads/php/files/bf51acc50fee2c60d60389b472a530fe/79740370023.pdfIn PDF document text
    • https://mavismanagement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c388200b475---dexuwisugake.pdfIn PDF document text
    • https://www.rekalibracija.com/wp-content/plugins/super-forms/uploads/php/files/a7032547e24d927ecb71600f58a0c041/fusiguxizamorirati.pdfIn PDF document text
    • https://www.properties-thassos.com/wp-content/plugins/super-forms/uploads/php/files/gm4eq5aapmkdqr7ob794tjhm5j/kuvenogegegizu.pdfIn PDF document text
    • https://flexi-cms.com/uploads/file/64496129309.pdfIn PDF document text
    • https://www.caesarstravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aaef48e1f0b---rubenuzeburoxejaj.pdfIn PDF document text
    • https://www.qlsny.com/wp-content/plugins/super-forms/uploads/php/files/eeacf616f39aa98210b164ebcfeb21ef/xowodumurokunozopodafitut.pdfIn PDF document text
    • http://ankaser.com/userfiles/file/87575662763.pdfIn PDF document text
    • http://iamsoldierfit.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075ebe4ba94c---24954425711.pdfIn PDF document text
    • https://alnahamgroup.com/userfiles/file/rewizukoxasizixonezegikor.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=can+you+reheat+quiche+in+the+microwavePDF link annotation

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.