Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe4855979a69bee4…

MALICIOUS

PDF

47.0 KB Created: 2021-07-05 00:03:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 7092a8d7c33d810d15f7f7c4490cac20 SHA-1: 5f1d0e2528fb297117d5fb69a8fa8e12fe52e184 SHA-256: fe4855979a69bee4041d9f6e20c7084fcf699a280b6da8ad83dac34cde102669
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It functions as a link farm, containing numerous URLs that point to compromised WordPress upload directories. These links likely serve to redirect users to malicious content or phishing pages, a common tactic for initial compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8512

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.putnamtaxi.net/wp-content/plugins/formcraft/file-upload/server/content/files/1608ebb763bed0---mewepokokuzapozep.pdf In PDF document text
    • http://nct-vn.com/userfiles/file/4071600782.pdfIn PDF document text
    • http://clearlakesd.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a0d78d903bc---zejirinop.pdfIn PDF document text
    • http://garystrike.com/clients/3/30/301ae0ed988f9237e4cb8f8c41f6cb36/File/61892379062.pdfIn PDF document text
    • http://furkansigorta.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160c1deea201de---xafobu.pdfIn PDF document text
    • https://sfeerweter.nl/userfiles/files/xiruni.pdfIn PDF document text
    • http://ednak.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609f0464afa48---pusurefugo.pdfIn PDF document text
    • https://syteq-pro.com/userfiles/file/90651246272.pdfIn PDF document text
    • https://www.techsrollout.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c7b493f3309---kemenasefubalixuzi.pdfIn PDF document text
    • http://mamaskitchenorder.com/uploads/files/kowizalobagumolekixixix.pdfIn PDF document text
    • http://alvasari.com/wp-content/plugins/formcraft/file-upload/server/content/files/160adca2a1958e---suzebikojavuwexuvewajix.pdfIn PDF document text
    • https://ratco-hardware.com/Ups/files/popenunalidedopus.pdfIn PDF document text
    • https://www.femregenx.co.za/wp-content/plugins/super-forms/uploads/php/files/46uh5m7855oai9g584673bf6k6/figege.pdfIn PDF document text
    • https://lokmangal.co.in/wp-content/plugins/super-forms/uploads/php/files/4691305a8ba9547d6f5f0147b8f2dd7c/sobepit.pdfIn PDF document text
    • https://teenvolunteerdallas.org/wp-content/plugins/super-forms/uploads/php/files/b0c97653b35d1eac4f66f749eaed5bce/xokixizavon.pdfIn PDF document text
    • http://itaindustrial.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a6aeccb0317---zajafamawisifevajafuf.pdfIn PDF document text
    • http://www.bufolari.com/public/immagini/file/50703831103.pdfIn PDF document text
    • https://nuregio.de/wp-content/plugins/formcraft/file-upload/server/content/files/160dcc14ae9e45---90169396434.pdfIn PDF document text
    • https://anaksemut.com/contents//files/61232290041.pdfIn PDF document text
    • http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d5d21298021---xuvakune.pdfIn PDF document text
    • https://asset-books.com/userfiles/file/xazasuxanada.pdfIn PDF document text
    • http://sns-russia.ru/userfiles/file/ropolexujapewutinow.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=indian+style+couscousPDF link annotation
    • http://kioskcondoweb.wpengine.com/wp-content/plugins/formcraft/file-upload/server/content/files/160afcf95ac955---nirexetirumiwo.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.