Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0b5cdd24f180708…

MALICIOUS

PDF

51.6 KB Created: 2021-05-28 09:42:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 5c74b7af48ba318fe33cefd4440446de SHA-1: e22a4e2a41d62d717470fe237af6a543b83e7b92 SHA-256: d0b5cdd24f180708b57f87772bbd71dd459bd6fccb0b021e06f2c26c0546075a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links to potentially compromised websites, disguised as search results for music downloads. Heuristics indicate it's a link farm on disposable hosting, and ClamAV detected it as a phishing trojan. The ML classifier also flagged it as malicious, suggesting it's designed to redirect users to malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7360

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/8e6b8e88407a173c6020d21ff6606144/87499598239.pdf In PDF document text
    • https://robertmatzuzi-massagetherapist.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606cee248cce3---sidazixeloxanewizukuro.pdfIn PDF document text
    • https://medok18.ru/wp-content/plugins/super-forms/uploads/php/files/0eef4fd0a646e48455fa084fcaee55b1/dapomujas.pdfIn PDF document text
    • https://blueridgelightingandcontrols.com/wp-content/plugins/super-forms/uploads/php/files/d03a276e824a1259af48ef65556a4048/59404143036.pdfIn PDF document text
    • https://bettenbaehren.de/wp-content/plugins/formcraft/file-upload/server/content/files/16099cf9abf421---18054282560.pdfIn PDF document text
    • https://planet-for-events.de/userfiles/file/sujav.pdfIn PDF document text
    • https://gmonlinestore.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c7721879d5---pedaf.pdfIn PDF document text
    • https://yarsan.ru/wp-content/plugins/super-forms/uploads/php/files/1278bcfbf25f1f4910bc600df202a98a/51046388097.pdfIn PDF document text
    • https://www.capitalroofingct.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070428a12642---pided.pdfIn PDF document text
    • https://prsnashville.com/wp-content/plugins/super-forms/uploads/php/files/4ee218e7d7ba417224d8a0ede85ddbe0/nopikedilabuve.pdfIn PDF document text
    • http://mispuntossaga.com/campannas/file/tewitonagujunes.pdfIn PDF document text
    • https://www.stjohnhomelessshelter.org/wp-content/plugins/super-forms/uploads/php/files/1422d78ed9a68d56c233521c6a0a69d6/66486248222.pdfIn PDF document text
    • http://fashioncenterpoint.com/wp-content/plugins/super-forms/uploads/php/files/ea99267c94d674c630926acdf9431812/laturaroso.pdfIn PDF document text
    • http://europeanprofservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083b1306b4b5---99924185344.pdfIn PDF document text
    • http://ahcxdq.com/uploads/file/290750195534.pdfIn PDF document text
    • https://areshin.ru/wp-content/plugins/super-forms/uploads/php/files/78c18ba35e067b7ceecfb2c77495098d/forudelojowavujeronakad.pdfIn PDF document text
    • http://wsm.hk/images/uploadfiles/file/82398300948.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/3vuEKuznOb8/uplcv?utm_term=ezel+dizi+music+mp3+downloadPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.