Malicious PDF — malware analysis report

Static analysis result for SHA-256 c860cef73931a41c…

MALICIOUS

PDF

51.6 KB Created: 2021-06-14 01:57:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 4e7da0c7c1f15ac39f48c7ab4692e031 SHA-1: df46a3cbc6cc62433681d5de9f108017f9f6d4db SHA-256: c860cef73931a41c304637075a00f22effd6ffff5363253290853089abcf806e
212 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file is identified as malicious by multiple heuristics and a machine learning classifier, including detections for redirector links and compromised CMS uploads. The document body, though heavily obfuscated, contains references to 'Attack on Titan season 1 full download', suggesting a lure to trick users into accessing malicious URLs. The embedded URLs point to known malicious redirectors and compromised WordPress sites, likely serving as a distribution point for further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7515

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wastran.ru/uplcv?utm_term=attack+on+titan+season+1+full+download In PDF document text
    • http://www.guaitoli.eng.br/wp-content/plugins/formcraft/file-upload/server/content/files/1606f276319b94---34378926955.pdfIn PDF document text
    • https://transcendenceit.com/wp-content/plugins/super-forms/uploads/php/files/f5c5edb71e14779aa196260473f17f00/54980511173.pdfIn PDF document text
    • http://cesishotel.lv/res/wysiwyg/file/22160111596.pdfIn PDF document text
    • https://hssipm.com/wp-content/plugins/super-forms/uploads/php/files/88712c8f280bdd133630da5907a226dd/fajexedafovitus.pdfIn PDF document text
    • http://xn----8sbpvg0afdbe.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/i97i2nebhdqco9g2r9qtkc4ie0/zedozagosunuk.pdfIn PDF document text
    • http://www.loicadesacavem.pt/wp-content/plugins/formcraft/file-upload/server/content/files/16082d9bdecb90---58854093745.pdfIn PDF document text
    • https://ahha.az/userfiles/file/86577517963.pdfIn PDF document text
    • http://ibb-online.ru/f/file/15462203601.pdfIn PDF document text
    • https://www.westcountrystoves.co.uk/wp-content/plugins/super-forms/uploads/php/files/8c4da863896f16b8906933a59114ffb4/zubane.pdfIn PDF document text
    • https://fitnessrev.net/wp-content/plugins/super-forms/uploads/php/files/9kom12tdpic8bbhmovin1k7afp/jufukanuzixamijo.pdfIn PDF document text
    • https://bikinibody.be/wp-content/plugins/super-forms/uploads/php/files/i58m6f2skt15b9d47dmhkb39v8/38561814259.pdfIn PDF document text
    • https://earplighting.com/wp-content/plugins/super-forms/uploads/php/files/3e493bf2bdbacd0b87f4e7d48defe31d/nemedikamevofukikobipo.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607aac9d20ff7---kududesipojerajo.pdfIn PDF document text
    • https://www.guestquesttravelmedia.com/wp-content/plugins/super-forms/uploads/php/files/opiep7g5nf4a2a9d0h63j5tssr/39174452842.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.