Malicious PDF — malware analysis report

Static analysis result for SHA-256 06b980637a429ca6…

MALICIOUS

PDF

58.6 KB Created: 2021-03-19 18:22:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 188e284bcc340744a218a8e1cd01da83 SHA-1: 7b2660cbb0ce4030dd27620a1d58d17b5d072198 SHA-256: 06b980637a429ca6eba8ad3882ebbd8ddb19bc64e1a15c6585aa09a5253a8406
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a heuristically identified random URL link and an embedded URL, both pointing to suspicious domains. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware delivery. The document body, though partially garbled, suggests a lure related to file conversion, which is a common tactic for social engineering.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8425

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=chuy%25E1%25BB%2583n+t%25E1%25BB%25AB+file+pdf+sang+file+%25E1%25BA%25A3nh+tr%25E1%25BB%25B1c+tuy%25E1%25BA%25BFn
    • https://static.s123-cdn-static.com/uploads/4377938/normal_5fff64f7e3b61.pdf
    • http://usesalon.xyz/12th_marksheet_2016558yb.pdf
    • http://zolugepusesotuj.iblogger.org/barcelona_mapa_metro.pdf
    • http://praktika-ingenieur.com/50348203743cds3a.pdf
    • http://puduvab.sportsontheweb.net/82583947960.pdf
    • http://segaruzobuguses.scienceontheweb.net/cengage_physics_neet_free_download.pdf
    • https://static.s123-cdn-static.com/uploads/4462345/normal_5ffec17e429e9.pdf
    • http://dajinanumiki.iblogger.org/marist_college_emerald_formal_2019.pdf
    • https://cdn-cms.f-static.net/uploads/4379477/normal_6054323fdc9ee.pdf
    • http://trelon.fun/57507961998s0lfn.pdf
    • https://cdn-cms.f-static.net/uploads/4463002/normal_6030507419779.pdf
    • http://getcabinets.xyz/ribexulomunezopudixizasopefjqm.pdf
    • http://veruvipavopa.getenjoyment.net/something_anything_nothing_exercises.pdf
    • https://uploads.strikinglycdn.com/files/410eec64-ea8c-4f5d-a93d-a9460f966e53/how_to_scan_document_with_hp_deskjet_2545.pdf
    • https://uploads.strikinglycdn.com/files/40b3f6c9-9a75-490c-b11d-f208e5f2b815/campark_trail_camera_settings.pdf
    • https://uploads.strikinglycdn.com/files/90007f70-e89f-4f93-95f3-dae02154fb5a/venime.pdf
    • https://uploads.strikinglycdn.com/files/a8b64d6d-2407-4ca1-ae5c-720ab93af1cf/35850665362.pdf
    • https://uploads.strikinglycdn.com/files/2d713c07-7fae-442a-ae18-a30eb9c3a784/69734851006.pdf
    • http://fugirar.epizy.com/budget_and_economic_survey_2020_summary.pdf
    • https://uploads.strikinglycdn.com/files/12a66db2-f089-4c6d-a813-7ad10fb1b499/shooting_an_elephant_george_orwell_thesis.pdf
    • https://uploads.strikinglycdn.com/files/505edc6c-ed02-4d55-a94e-bbb2cf1170c3/site_para_ler_livros_gratis.pdf
    • https://uploads.strikinglycdn.com/files/81f54470-90b4-4396-89d5-5855d62eb4f2/clasificacion_de_las_cuentas_en_el_estado_de_resultados.pdf
    • http://xowobovu.myartsonline.com/analytical_geometry_3d_vector_calculus.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.