PDF malware analysis — malicious · fbea4a315c32f757

MALICIOUS

PDF

58.6 KB Created: 2021-06-20 18:08:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9b4bb5d3095c0f2947d296f3ba4c92b7 SHA-1: a539c89bb2951542fdbdf6409e6a084e638b08e3 SHA-256: fbea4a315c32f7574fc3de775ea41f80f45086cab564075dad59d3e107d6057b

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains multiple links to external websites, many of which are hosted on compromised WordPress sites. These links are presented as download sources for a "company profile presentation ppt free download", indicating a phishing or malware distribution attempt. The ClamAV detection and ML classifier further support the malicious nature of this file.

Machine Learning

Nyx PDF Classifier malicious score 0.6699

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nomylo.ru/uplcv?utm_term=company+profile+presentation+ppt+free+download
- https://mediabandit.com/wp-content/plugins/formcraft/file-upload/server/content/files/16096452b23e7b---29996288025.pdf
- http://ptk-astana.kz/wp-content/plugins/super-forms/uploads/php/files/c9d10734f926f0f68480822caf246866/vomujoreriti.pdf
- http://skipjackpoke.com/ckfinder/userfiles/files/45768698705.pdf
- http://vladjurnalist.ru/archive/file/vikutixivix.pdf
- https://thietbivesinhanhhuy.com/asset/files/vixarufuxilapep.pdf
- https://www.caesarstravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609f0d5de4e68---rinonivixudu.pdf
- https://planet-for-events.de/userfiles/file/dejafipugalam.pdf
- https://www.karavanlakesfet.com/wp-content/plugins/super-forms/uploads/php/files/8251063cd55e6d949c37629c76c33d1a/mabaduzakib.pdf
- https://claphamjunction.com.au/wp-content/plugins/super-forms/uploads/php/files/1bcb99644a6706b9a5b871ee7871e45f/70062021627.pdf
- https://kamber.dk/wp-content/plugins/super-forms/uploads/php/files/a99a4d36447061d6f91715c7794d992f/29819638311.pdf
- http://gingerwooddesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/160791d770d0e1---tudidukogurovewerotire.pdf
- http://amfmeg.org/wp-content/plugins/formcraft/file-upload/server/content/files/160be55197558f---75908800647.pdf
- https://realestateconnect.biz/wp-content/plugins/super-forms/uploads/php/files/1gljsceekkgt05c0326fgj6so2/zugapizu.pdf
- http://matstravel.ru/userfiles/file/diditibik.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.