Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd9743c6028268cb…

MALICIOUS

PDF

62.5 KB Created: 2021-09-16 06:02:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: aa9c39f43b8a8db4245cc707dcdd05de SHA-1: 0bd44a3b4f9e03bc9e2bde36fa4d991ac14939c8 SHA-256: dd9743c6028268cb9839530aab6f625e9edfeb3008f41106a804673ab6fdc219
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains embedded JavaScript and a significant number of external links, many pointing to compromised websites or disposable hosting. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a deliberate attempt to create a link farm, likely to obscure malicious destinations or for SEO manipulation. The embedded JavaScript, while not fully analyzed due to obfuscation, is a common method for initiating malicious actions in PDFs. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5915

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://coretry.ru/uplcv?utm_term=bala+kanda+telugu+book+pdf PDF link annotation
    • http://josephfellerlaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/varodofibofukumapiwugogof.pdfIn PDF document text
    • https://www.grandeprairie.org/wp-content/plugins/formcraft/file-upload/server/content/files/16139a57e4a2f8---75362038378.pdfIn PDF document text
    • https://mygamedaysports.com/wp-content/plugins/super-forms/uploads/php/files/ab6f2ba1ed80fba15a362792965c8457/85529479405.pdfIn PDF document text
    • http://hiniceshine.com/upload/14888363423.pdfIn PDF document text
    • https://www.bluegreenshouseboats.in/wp-content/plugins/formcraft/file-upload/server/content/files/1613ad1f8c0779---1741045000.pdfIn PDF document text
    • http://lnv-cnc.com/userfiles/file/35994752385.pdfIn PDF document text
    • http://mea-travel.pl/userfiles/file/jukubimozijem.pdfIn PDF document text
    • https://propactionvehiclesuk.tv/userfiles/files/kopafanab.pdfIn PDF document text
    • https://searchkar.com/ci/userfiles/files/49209652513.pdfIn PDF document text
    • http://dachastyle.com/userfiles/file/fokaseburixizagu.pdfIn PDF document text
    • https://chungcungoaigiao.vnpec.xyz/uploads/files/85439562061.pdfIn PDF document text
    • http://xn--80adpfaaeictf0c6c7i.xn--p1ai/public/file/kurosuwep.pdfIn PDF document text
    • https://rowanmkt.com/Uploads/ckfinder/userfiles/files/kasedulepazixulasajanudob.pdfIn PDF document text
    • http://twgo8.com/uploads/base/files/202109022001006547.pdfIn PDF document text
    • https://heatingboiler.ca/fck_upload/file/51121684222.pdfIn PDF document text
    • https://efsanepin.com/calisma2/files/uploads/37122737118.pdfIn PDF document text
    • https://nevjegyzek.eu/uploads/file/56301749435.pdfIn PDF document text
    • https://chachachat.info/js/ckfinder/userfiles/files/xilijedoti.pdfIn PDF document text
    • http://www.tobywells.org/media/fckdir/file/92522553241.pdfIn PDF document text
    • https://rrrc.us/userfiles/file/50805028558.pdfIn PDF document text
    • http://paradisoseminatrici.it/userfiles/files/57957823206.pdfIn PDF document text
    • https://hoffmanowska.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16135e4e37256c---musadakideri.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.