PDF malware analysis — malicious · f1930464d2a6395b

MALICIOUS

PDF

55.7 KB Created: 2021-06-04 02:55:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a5a97f9df6a71f270cde3bb3bed4a31d SHA-1: 6ec4fa2b133ee5d8372bdf551277ea1ae06ae97e SHA-256: f1930464d2a6395b5ff14b1e2d0e6678252230efcb0d1de618d1a3a5ad72b8b9

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links, many hosted on compromised CMS upload directories, suggesting a link farm designed to redirect users to potentially harmful content. The presence of external URIs and the overall structure point towards a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.6699

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pistant.ru/uplcv?utm_term=cobra+zero+limits+driver+settings
- https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a2021a3ea44---36066394062.pdf
- https://earthideasawnings.com/wp-content/plugins/formcraft/file-upload/server/content/files/160795d55c3b16---70537618408.pdf
- http://terezmisszio.eu/files/file/zojezepatiber.pdf
- https://www.saenger-ohg.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606c91292e1fa---tebuvuwiv.pdf
- https://relleno-acidohialuronico.com/wp-content/plugins/super-forms/uploads/php/files/ffa5d32f8e3d1f322beedb4f4aeb1153/24146343737.pdf
- http://begemot-rus.com/uploadfiles/file/2021051612542673499.pdf
- https://rrvchefs.com/wp-content/plugins/super-forms/uploads/php/files/d36be4416fba8dca2b57b39b723f7770/43639614417.pdf
- http://cn-junsheng.com/upload/file/%5C/20216452754892.pdf
- https://www.abaco-engineering.it/wp-content/plugins/formcraft/file-upload/server/content/files/1609a874308e67---velos.pdf
- http://sosonomo.com/ckfinder/userfiles/files/31868487827.pdf
- http://www.appsolutely.sg/wp-content/plugins/formcraft/file-upload/server/content/files/16093aa900672a---11526086527.pdf
- http://elisa5888.com/shopadmin/upload/files/vujukabi.pdf
- http://aksaaydinlatma.com/img/editor/image/file/lamatuxekakep.pdf
- http://www.kidnuri.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608d7d375d478---judazavevinedejaxuv.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.