Malicious PDF — malware analysis report

Static analysis result for SHA-256 f38b980c92990452…

MALICIOUS

PDF

62.2 KB Created: 2021-08-24 10:56:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14
MD5: adc83f8e0c0573f6c7f14609d27ce34b SHA-1: 24916f6343d7fd51d7ed58895c62f1e6fb02a021 SHA-256: f38b980c929904529014710555f7e28925eff84751b6128f5afb3df94cd616a7
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, containing numerous external URIs that likely lead to phishing sites or further malware downloads. The presence of compromised CMS upload links suggests a technique to host malicious content on seemingly legitimate but compromised websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9286

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://krisoc.ru/uplcv?utm_term=billy%27s+plumbing+and+rooter PDF link annotation
    • http://sun-green.nl/ckfinder/userfiles/files/papazatafolef.pdfIn PDF document text
    • http://www.alwaysflorida.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609177d0d1f13---liriroxunukelize.pdfIn PDF document text
    • http://smartcookieacademy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cfbba062dd0---viriko.pdfIn PDF document text
    • https://kakvkusno26.ru/wp-content/plugins/super-forms/uploads/php/files/7bfe72e6120446af8fe09d856fe45966/8825098440.pdfIn PDF document text
    • https://webhostmurah.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084ebe2ce609---rezegaboweti.pdfIn PDF document text
    • https://dm288.com/slicice/file/88210926980.pdfIn PDF document text
    • https://www.goldenplanet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1608f1f23b5e40---42028519668.pdfIn PDF document text
    • https://glasschneider.koeln/wp-content/plugins/super-forms/uploads/php/files/vgrtds2koenigaci14ghqfbaiv/34332598299.pdfIn PDF document text
    • https://akdenizokullari.k12.tr/wp-content/plugins/super-forms/uploads/php/files/knep8r3nmm0nl06rvags2rmo79/felunegatonorexi.pdfIn PDF document text
    • http://www.hydro-tg.pro/upload/file/22485593995.pdfIn PDF document text
    • https://www.lipfish.no/wp-content/plugins/formcraft/file-upload/server/content/files/1608e0c666dbd4---fijovasovoxokuxefaf.pdfIn PDF document text
    • http://www.aluvascientific.com/UserFiles/file/zuvixizemevofapofolaxub.pdfIn PDF document text
    • http://anabakorea.jp/userfiles/file/79722592589.pdfIn PDF document text
    • http://jtour.vn/userfiles/file/64779348634.pdfIn PDF document text
    • https://gpuhub.net/wp-content/plugins/super-forms/uploads/php/files/r99ilm7vo652kvmuh2jm2vp1fm/30045760941.pdfIn PDF document text
    • https://olgapopovaphoto.com/wp-content/plugins/super-forms/uploads/php/files/0f4522614abfd4f1cdf3bd1fbe53d27f/47920488077.pdfIn PDF document text
    • http://deborahbrown.us/clients/860103/File/kajekojis.pdfIn PDF document text
    • https://eletmodguru.hu/files/files/dodil.pdfIn PDF document text
    • http://h-st.nl/bestanden/files/vinofowuwulomigekimiweje.pdfIn PDF document text
    • https://debcopharma.com/userfiles/file/tomubuvo.pdfIn PDF document text
    • https://cardion.dk/gfx/fckimages/file/pegenaxiwemurike.pdfIn PDF document text
    • https://howardsteeves.com/wp-content/plugins/super-forms/uploads/php/files/e9370dd339fcb5eebd2e983cafd116ec/92968896028.pdfIn PDF document text
    • https://www.bakirkoytemsilcisi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160720afbad448---xolotovonokujapatesoso.pdfIn PDF document text
    • http://studio-castiglioni.com/userfiles/files/7807844196.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.