Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc25eddf31a03e8e…

MALICIOUS

PDF

67.9 KB Created: 2021-07-14 04:17:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: d47bea48cc704cbaea5ebcd22fab21ba SHA-1: 22fd6216f08625e2d7b483c97101f01eda6c6e97 SHA-256: fc25eddf31a03e8e63b5a2ec0490e35cc00d9d0dc134dcb92c547f46a1f2ce89
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as malicious by ClamAV, indicating a phishing or trojan threat. It functions as a link farm, containing numerous URLs pointing to various websites, some of which are hosted on compromised WordPress upload storage. The presence of 'utm_term' parameters suggests an attempt to track user engagement with potentially malicious links.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4829

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dispomydeal.com/wp-content/plugins/super-forms/uploads/php/files/83c7f9507ac6f17228d7d9f75dd146c8/68339385352.pdf In PDF document text
    • http://alfavs.eu/userfiles/file/zopawopafakupivelofaj.pdfIn PDF document text
    • https://nhachoxebus.com/upload/fck/file/14208113650.pdfIn PDF document text
    • https://lea-inc.com/wp-content/plugins/super-forms/uploads/php/files/5a9f03c00985babb54290a87405dd92d/nironeketiravidotodigiz.pdfIn PDF document text
    • http://feach.ie/images/uploads/file/43340923417.pdfIn PDF document text
    • http://apsencollege.org/test/fckeditor/file/23647845043.pdfIn PDF document text
    • https://c-effeimmobiliare.it/file/jamevufebugodita.pdfIn PDF document text
    • http://www.greenbriarpropmgmt.com/wp-content/plugins/super-forms/uploads/php/files/f7586a6a36b2f2b01d335a39ec1de513/95606575471.pdfIn PDF document text
    • http://ahcxdq.com/uploads/file/031736524679.pdfIn PDF document text
    • https://www.helpagesl.org/wp-content/plugins/formcraft/file-upload/server/content/files/16082c3b7f1b8a---zemovujimaneg.pdfIn PDF document text
    • http://bannermaul.com/userData/board/file/zoxux.pdfIn PDF document text
    • http://www.orarestauratorisaf.it/wp-content/plugins/formcraft/file-upload/server/content/files/160b8da3ced9a7---pewivurudorukolonulok.pdfIn PDF document text
    • http://seamacros.com/upload/file/xajawejamurawegipike.pdfIn PDF document text
    • http://industrialdevices.in/uploads/timave.pdfIn PDF document text
    • http://thehawthornnyc.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a4821cf8f5---gapegomiwuvuropi.pdfIn PDF document text
    • https://lightupalife.org.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160821ee41c1a7---87049053083.pdfIn PDF document text
    • http://tai-yang.tw/taiyang/upload/file/41551813528.pdfIn PDF document text
    • https://christianboudreau.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aab01b1a6c3---28623713126.pdfIn PDF document text
    • http://romento.com/uploaded_files/userfiles/files/gamirupugipinorus.pdfIn PDF document text
    • http://www.appsolutely.sg/wp-content/plugins/formcraft/file-upload/server/content/files/1609df0d439ae0---pijelag.pdfIn PDF document text
    • https://floorco.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/f5bb7e818705887ec9fcb818b4b10c12/xapotiwasepujob.pdfIn PDF document text
    • http://noahsmarinesurveyors.ca/userfiles/file/62835242570.pdfIn PDF document text
    • http://cmtdental.com/upload/ckimg/files/99262541887.pdfIn PDF document text
    • http://postelezmasivu-brno.com/ckfinder/userfiles/files/82099722548.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=how+to+sell+sexy+pictures+onlinePDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.