Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8574d439f1d651d…

MALICIOUS

PDF

119.4 KB Created: 2021-09-07 12:51:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: 1855fb0d8580bed6fa1e02a844a7f898 SHA-1: 4d76198edf325d57d05eccd3c2bf2ca9c686c597 SHA-256: c8574d439f1d651ddacb305f88073fc420bb1db2393e1a6afd0c718099c8df97
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links, many of which point to compromised WordPress sites, suggesting a link farm designed to lure users to potentially malicious content. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent. The ML classifier also flagged the PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6054

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://averon.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160bfc11b71954---kumisexokulizax.pdf In PDF document text
    • https://www.heracles-hotel.eu/wp-content/plugins/super-forms/uploads/php/files/7qtre60a5mlouvq8tkrtdh531j/91949612074.pdfIn PDF document text
    • https://mszukam.pl/dat//file/zejekemodejosotemumarixo.pdfIn PDF document text
    • https://gamedunyasi.com/calisma2/files/uploads/74603827699.pdfIn PDF document text
    • https://eyescare.vn/app/webroot/upload/ckfinder/files/nubawefixuwefi.pdfIn PDF document text
    • https://altstudio.be/app/webroot/uploads/file/96176595029.pdfIn PDF document text
    • https://ailani.org/wp-content/plugins/super-forms/uploads/php/files/86f6dd7a1c1216b24226b7f48cc994d3/32300746506.pdfIn PDF document text
    • https://nusbetaja2.com/contents//files/94752717564.pdfIn PDF document text
    • https://granitabrasive.hu/editor_up/88220769719.pdfIn PDF document text
    • https://www.davidwoodpersonnel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087ed19a01f2---53745468189.pdfIn PDF document text
    • https://callhfelectric.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612c10dd3a344---63834962907.pdfIn PDF document text
    • http://dochoiotovn.com/uploads/userfiles/file/97676085364.pdfIn PDF document text
    • https://drddvichitra.com/userfiles/file/tisibidev.pdfIn PDF document text
    • https://tecsal.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16070e7c16a361---faludixuroxob.pdfIn PDF document text
    • http://inwallendorf.de/userfiles/file/44624016167.pdfIn PDF document text
    • https://advancedcheckcashadvance.com/wp-content/plugins/formcraft/file-upload/server/content/files/160812cda36dcc---botejulalewezuzaxor.pdfIn PDF document text
    • http://vhktn.at/images/content/files/33490308601.pdfIn PDF document text
    • https://bokseinstituttet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/16132c32637a79---61583095813.pdfIn PDF document text
    • https://wsbtitan.com/images/file/tirorudutezolojimibiruf.pdfIn PDF document text
    • http://yeosingol.com/FileData/ckfinder/files/20210830_DB919E8BB8270345.pdfIn PDF document text
    • https://costumeworld.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072035c9d4cf---36629052810.pdfIn PDF document text
    • http://podwierzba.eu/ckfinder/userfiles/files/riron.pdfIn PDF document text
    • http://serdceprirody.ru/userfiles/file/ronegijojibakelelana.pdfIn PDF document text
    • http://yourtruck.be/upload/ckeditor/file/kovotasawuxi.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/YTWXjIUwRh0/uplcv?utm_term=sociologia+juridica+definicion+pdfPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.