Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc93c32128f09c2b…

MALICIOUS

PDF

50.1 KB Created: 2021-09-06 23:28:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 5d8a96ce58ee1ca637376a830854eb1c SHA-1: 1726cf50aac63d60c679a0cc029235953d45c742 SHA-256: dc93c32128f09c2b385e8f6b905d2f16a3f7ba4d7794b2923d03f64908d8ab22
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as a malicious PDF by ClamAV and an ML classifier, indicating a phishing or trojan payload. The PDF contains numerous links, many pointing to disposable hosting or compromised CMS upload directories, suggesting a link farm designed to redirect users to malicious sites. While no scripts were explicitly extracted, the PDF structure and URL patterns are indicative of a phishing lure or a downloader for a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6227

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tjpapigroup3.com/contents//files/95116688748.pdf In PDF document text
    • https://wheelmartthailand.com/image/upload/File/verinulemojev.pdfIn PDF document text
    • https://nuevocoach.co.uk/wp-content/plugins/super-forms/uploads/php/files/a9d98ae76eec947c4308897fa8da8d4d/fudidapuvekokezesegesi.pdfIn PDF document text
    • https://www.pfgpartners.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16071663175aed---mexis.pdfIn PDF document text
    • https://davebakeragency.com/wp-content/plugins/super-forms/uploads/php/files/0b944b2590419cbc050c97e3fefee501/86650394147.pdfIn PDF document text
    • http://lysfyyy.com/upload/files/39929426686.pdfIn PDF document text
    • https://towa-aaa.jp/userfiles/file/39035667137.pdfIn PDF document text
    • https://aliencosmicexpo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a90daea1c3b---dekogil.pdfIn PDF document text
    • https://unitedcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b4702f0f810---4036153473.pdfIn PDF document text
    • http://aryajob.com/user_upload/file/lesizuwonitisagabodaw.pdfIn PDF document text
    • https://www.aicsmindia.org/ckfinder/userfiles/files/sawaletado.pdfIn PDF document text
    • http://www.holderit.com/wp-content/plugins/formcraft/file-upload/server/content/files/160871402b374c---foxekavuwew.pdfIn PDF document text
    • https://mszukam.pl/dat//file/koviz.pdfIn PDF document text
    • http://cherriestattoo.com/ckfinder/userfiles/files/77274345749.pdfIn PDF document text
    • http://alexanderkanevskyartgallery.com/clientMedia/file/pivowevasinog.pdfIn PDF document text
    • http://laibros.com/ckeditor/userfiles/files/jinusaseredatiloravu.pdfIn PDF document text
    • http://sibaco.ru/ckfinder/userfiles/files/kojufamelixogebuwi.pdfIn PDF document text
    • http://csptech.net/admin/userfiles/file/89534460375.pdfIn PDF document text
    • https://sketchup360.vn/wp-content/plugins/super-forms/uploads/php/files/i3pj230o91s238d58rlievbn1p/zofogezud.pdfIn PDF document text
    • https://elnativocoffee.com/silver/upload/files/13661965208.pdfIn PDF document text
    • http://yonseri.org/userfiles/files/tijozusazabem.pdfIn PDF document text
    • http://mini-garden.ru/userfiles/file/gikegifutad.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BvfzZFkJO3s/uplcv?utm_term=cours+electrocardiogramme+pdfPDF link annotation
    • http://kioskcondoweb.wpengine.com/wp-content/plugins/formcraft/file-upload/server/content/files/160744ee94c88c---69183559611.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.