Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6533f324c8c13a3…

MALICIOUS

PDF

83.6 KB Created: 2021-09-08 11:43:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: d0aabc5cbf2d580e5ecc2f914d3c5e7a SHA-1: 83b6a4be1a3e66525ea57ac1e84708dac8a9769d SHA-256: f6533f324c8c13a311411407172b184496b8cd8bdd6b84380e164f17000ebd4d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs, many of which point to compromised CMS uploads or disposable hosting, suggesting a link farm designed to distribute malicious content or phish users. The ClamAV detection and ML classifier further support its malicious nature. No scripts were extracted, but the structure indicates a malicious document delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5355

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/uplcv?utm_term=bukhari+sharif+pdf+file
    • http://denetimmusavirlik.com/userfiles/file/juvevij.pdf
    • http://www.orhancoskun.com/wp-content/plugins/formcraft/file-upload/server/content/files/160fb644276fc9---78988563245.pdf
    • https://biserica-izvorul-tamaduirii.ro/files/nanetekanupabojef.pdf
    • http://abovomedia.hu/_user/file/jefope.pdf
    • http://15thstpresbyterian.org/clients/d/d7/d7025cfb1d4df99eee5a588ecc3dd57f/File/22648604867.pdf
    • https://www.modianodesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a5cfaebc467---33167724009.pdf
    • http://bentleyplemtech.ru/userfiles/file/jesuxirejogu.pdf
    • https://inchirieriavioane.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1608fe6a4bb84d---mumibixid.pdf
    • https://gbagencement.fr/uploads/file/77889900786.pdf
    • https://nutricionintravenosa.com/wp-content/plugins/super-forms/uploads/php/files/49d0d44acfcf505f70ba57f2159342b5/laxedexepisepalati.pdf
    • https://www.hs-hofgastein.salzburg.at/ckfinder/userfiles/files/ropagevojixitigulokez.pdf
    • http://chinalanpa.com/images/upload/File/jogolivub.pdf
    • http://nc-israel.ru/upload/files/48180702938.pdf
    • http://www.justgiveahand.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a42e9c56bc1---50178197437.pdf
    • https://calldidocta.com/wp-content/plugins/super-forms/uploads/php/files/76a6c1e667cc97f4e707a4f642a03043/virajofamasilomanowo.pdf
    • http://prakseologia.eu/userfiles/file/silowaxajutekesagezin.pdf
    • http://bradhelferlaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/fisozewabuvid.pdf
    • http://mijneigenlift.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c2fc78aec88---vogadibezekotagumabev.pdf
    • http://sieckultury.pl/wp-content/plugins/super-forms/uploads/php/files/514eba8f128aea1f806643a6368af7e5/puvaziwawaf.pdf
    • http://vilaportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/160977c239443f---xemeledizilalugija.pdf
    • https://www.glasswindowequipment.com/wp-content/plugins/super-forms/uploads/php/files/7fc36b214d7c0f44d21716736ea8946b/fulekezabokipaxemunine.pdf
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/9hihtv32t7bghsgqjdvej22gd3/13660184325.pdf
    • https://itracmediav5.com/ckfinder/userfiles/files/19284963394.pdf
    • http://german-ex.com/images/blog/file/valojesemuvuw.pdf
    • https://reitinguok.lt/userfiles/file/5450936896.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.