Malicious PDF — malware analysis report

Static analysis result for SHA-256 07172e5d0fed237b…

MALICIOUS

PDF

50.3 KB Created: 2021-03-28 19:51:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0d060b1365f448132b3ad35da58f7ed1 SHA-1: cc940106574b28bdb89653b57a1dec9e5d5a9ffc SHA-256: 07172e5d0fed237b3b1b4775c0cf32a3af3dfb01b9a176d30613e030545ae263
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ClamAV and an ML classifier, and exhibits characteristics of a phishing lure. It contains an embedded URI pointing to 'baarspo.ru', which is likely part of a phishing campaign. The document body is heavily obfuscated, but the presence of an image-only lure and an external URI strongly suggests an attempt to redirect the user to a malicious website for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8343

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=nuevo+diccionario+biblico+ilustrado+pdf+gratis
    • https://cdn.sqhk.co/vovomafejuwa/jgTyaM5/86095391642.pdf
    • https://cdn.sqhk.co/wuwexosul/hdrgd1r/turbo_drift_3d_car_racing_2017_apk.pdf
    • https://cdn.sqhk.co/gixobujikelu/J8jjWNe/driftwood_texas_to_austin_texas.pdf
    • http://flipping-car.online/94404239227ynher.pdf
    • http://itprod.space/learn_english_grammar_in_urduwdyoy.pdf
    • https://cdn.sqhk.co/nerutamar/gfjigeW/baby_songs_sleep_time.pdf
    • https://cdn.sqhk.co/bivuwusim/khbriae/37160624150.pdf
    • http://verenica.net/mirajitufovituzikofinncpm4.pdf
    • http://kieverts.xyz/housing_act_1988_section_8_formwwpia.pdf
    • http://swiss-gear-top.xyz/how_to_draw_a_nose_from_the_side_easyu6dor.pdf
    • https://s3.amazonaws.com/diwitapezu/reporte_de_alumbrado_publico_tlaquepaque.pdf
    • https://s3.amazonaws.com/fasudikek/47441968722.pdf
    • https://s3.amazonaws.com/fokapikow/estadistica_descriptiva_uned.pdf
    • http://nomekerileme.epizy.com/white_platform_sneakers_2019.pdf
    • http://jizuwugi.rf.gd/rivuvavirasilegetuma.pdf
    • https://s3.amazonaws.com/vatosolikijike/pubojinifawawufodosamif.pdf
    • http://nufiwimuzobo.onlinewebshop.net/do_front_airbags_deploy_rear_end_collision.pdf
    • http://lixugafepujijoj.onlinewebshop.net/technological_advances_in_the_treatment_of_type_1_diabetes.pdf
    • https://s3.amazonaws.com/wixanarer/free_photo_calendar_template_2019_word.pdf
    • https://s3.amazonaws.com/lovomijelun/rca_rc205_dual_alarm_clock_radio.pdf
    • https://s3.amazonaws.com/lovomijelun/free_texture_wood_floor.pdf
    • http://nukivamo.myartsonline.com/magic_tree_house_55_release_date.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.