Malicious PDF — malware analysis report

Static analysis result for SHA-256 68a0696a989220cb…

MALICIOUS

PDF

195.8 KB Created: 2021-06-23 23:47:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 253cd19c478b37a390c5f5de329b690f SHA-1: 873b7750c25ec72330316c4b05bd3473b8a67a45 SHA-256: 68a0696a989220cbb3f7e88772ccde14b937dbed6f7d07b4f37b2179ecac8bfa
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a link farm pointing to compromised WordPress sites, likely intended to host or distribute further malicious content. The embedded URL 'https://laborke.ru/uplcv?utm_term=silesia+confiserie+manual' is a primary indicator of the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9732

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/uplcv?utm_term=silesia+confiserie+manual PDF link annotation
    • http://wksystems.net/HotelEstimator/userfiles/file/69410413354.pdfIn PDF document text
    • http://www.kzhep.in.ua/wp-content/plugins/super-forms/uploads/php/files/dguohsbbddv2dnj8pnhddsv2n7/80553727157.pdfIn PDF document text
    • http://www.skup.it/wp-content/plugins/formcraft/file-upload/server/content/files/1609c8c370ba6d---fuwuzapokukaropoliw.pdfIn PDF document text
    • https://wecafephuket.com/wp-content/plugins/super-forms/uploads/php/files/sthghr2j78m0nefmmd4f22kicr/gukurezorug.pdfIn PDF document text
    • https://www.hinogas.com/wp-content/plugins/super-forms/uploads/php/files/7ina225if0aq58oeofefhrmlsb/patepidazowoko.pdfIn PDF document text
    • http://www.iycadana.org/wp-content/plugins/super-forms/uploads/php/files/airkmv0va8dpur2bsd179pou91/32438887063.pdfIn PDF document text
    • http://www.chinahkcarplate.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a279473c68f---libamusomaxizilonu.pdfIn PDF document text
    • https://globalazeri.az/wp-content/plugins/super-forms/uploads/php/files/2rh0qla5nlmumkh3dlo2kf9fc0/77625777846.pdfIn PDF document text
    • https://www.beewellrx.com/wp-content/plugins/super-forms/uploads/php/files/tmp/54212515981.pdfIn PDF document text
    • https://harpethvalleyhealth.com/wp-content/plugins/super-forms/uploads/php/files/f4a03892862185d523a9d0d7c9f2481c/remijaxodivixomapepuvep.pdfIn PDF document text
    • https://www.euroservicemilano.it/wp-content/plugins/formcraft/file-upload/server/content/files/1606c660f32421---baximaraxumoj.pdfIn PDF document text
    • http://cartonwrappingmachine.com/userfiles/file/gimoxutimivut.pdfIn PDF document text
    • http://pebyte.com/wp-content/plugins/super-forms/uploads/php/files/7aih1eevj1peijd1u18mv8m9bi/liwubegub.pdfIn PDF document text
    • https://malimbe.africa/wp-content/plugins/super-forms/uploads/php/files/603cd49bed82e58d4c8b3f37ed3ed75f/pamovalisirudusimamazo.pdfIn PDF document text
    • https://educhina.mn/editor/files/vipofivekobi.pdfIn PDF document text
    • https://xn--80aaaglcftt5alesfkk7f.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/9cf55d1eb7c3dead2646c55a3900292d/44061314955.pdfIn PDF document text
    • https://ecef-groupe.com/wp-content/plugins/super-forms/uploads/php/files/jogech1f4beir1p8mr78q4qu24/bixebudexizebivabe.pdfIn PDF document text
    • http://www.julitolaschools.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ffd765a9bf---tovajipo.pdfIn PDF document text
    • http://app8itebarandgrill.com/admin/images/file/46918723414.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.