Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8336ea19c5002d3…

MALICIOUS

PDF

64.0 KB Created: 2021-06-12 18:32:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: fdba119237ac4d277d973303d63349be SHA-1: 4b6d15fcced9d3434b2e36bb06f785401b050568 SHA-256: d8336ea19c5002d3d05670a1384174a5933eb44aef3677e4a780d8cde0dad472
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file is classified as malicious by ML models and ClamAV, indicating it's a phishing or trojan delivery mechanism. It contains numerous links, many pointing to compromised WordPress sites and disposable hosting, suggesting a link farm designed to redirect users to malicious content. The embedded document body text, though obfuscated, appears to be a lure related to a TV show episode, aiming to trick users into clicking the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7653

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/uplcv?utm_term=mha+season+4+episode+24+dub PDF link annotation
    • https://www.spreefahrten-berlin.de/wp-content/plugins/super-forms/uploads/php/files/i7hflaleq4d1189te6o7n9u9jh/73719187543.pdfIn PDF document text
    • http://georgekoldun.com/var/upload/file/63724942903.pdfIn PDF document text
    • https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/d4ff5edd8bfe5bb498663b634c6cce8e/kimewinevokaza.pdfIn PDF document text
    • https://bikinibody.be/wp-content/plugins/super-forms/uploads/php/files/khvd7b8u2uar0fcv6qr2r7mro5/79418424720.pdfIn PDF document text
    • https://law.myvzl.com/wp-content/plugins/super-forms/uploads/php/files/3789fiqs2v6g9p9cmkd6hfekon/pisuzufezad.pdfIn PDF document text
    • https://upchealth.net/wp-content/plugins/super-forms/uploads/php/files/f4a98fd082a0ea52afe21ac1ebf27d13/61605677866.pdfIn PDF document text
    • https://sckprime.com/wp-content/plugins/super-forms/uploads/php/files/e1365bd559cb00c741acf052cac947be/15736941371.pdfIn PDF document text
    • http://sghscsjamarai.org/guruhargobind/userfiles/file/79550182688.pdfIn PDF document text
    • http://perilatomsk.ru/ckfinder/userfiles/files/jolimepugo.pdfIn PDF document text
    • https://ensasoft.com.tr/wp-content/plugins/super-forms/uploads/php/files/rgts9qvlmjbfksgmmg8e3mueh4/65188367275.pdfIn PDF document text
    • http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079ab38cd6a8---70374885919.pdfIn PDF document text
    • https://duext.com/wp-content/plugins/super-forms/uploads/php/files/3a5f67a7b4fee1de1a01a0d3d401e9ee/xojusom.pdfIn PDF document text
    • https://heritagelogs.com/wp-content/plugins/super-forms/uploads/php/files/iq0bor4cllc4m5o6ile3c4u8n2/zalid.pdfIn PDF document text
    • http://glotecgh.com/upload/editor/file/45290182227.pdfIn PDF document text
    • http://ne-moloko.ee/wp-content/plugins/super-forms/uploads/php/files/53c7c1a41d35daa9ef0b411fef6589ec/74002771030.pdfIn PDF document text
    • https://weinquartier.at/wp-content/plugins/super-forms/uploads/php/files/e9eefb66d6c1f461925491469c7ae7d4/37920251329.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.