Malicious PDF — malware analysis report

Static analysis result for SHA-256 0930a02a33d02388…

MALICIOUS

PDF

49.6 KB Created: 2020-12-27 19:16:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 38d775958240c73e869638d41a0c2caa SHA-1: b140bd1c8a83dd631925cf47ae70501dbb0a612f SHA-256: 0930a02a33d023880cb44e474eb24dc4662e5c0c492fcf40670c21363d8bad8f
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, 'traffnew.ru', which is likely used to host a malicious payload or phishing content. The document body, though heavily obfuscated, suggests a lure related to a 'cold patch tonnage calculator'. No scripts were extracted, but the PDF structure and embedded URI indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7327

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/strik?utm_term=cold+patch+tonnage+calculator PDF link annotation
    • https://cdn.sqhk.co/zupodejadofe/wjchjiH/48137739695.pdfIn PDF document text
    • https://cdn.sqhk.co/zawatilirip/hghhibO/91497491791.pdfIn PDF document text
    • https://cdn.sqhk.co/podadoxafa/iaifXji/3d_crystal_puzzle_castle_directions.pdfIn PDF document text
    • https://cdn.sqhk.co/juxerawabuf/zPAqCjc/monkey_king_demon_battle_apk_mod.pdfIn PDF document text
    • https://cdn.sqhk.co/domuduxuro/ejdjajh/spectrobes_origins_wiki.pdfIn PDF document text
    • https://cdn.sqhk.co/rawegili/shbjjT3/74542236959.pdfIn PDF document text
    • https://cdn.sqhk.co/sofaxuleruri/ZjiujdB/study_skills_for_middle_school_activities.pdfIn PDF document text
    • https://cdn.sqhk.co/renerolodepu/irgchg2/horizon_flight_simulator_2019_mod_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/kolazapikib/4biijd3/create_a_grocery_list_online_with_prices.pdfIn PDF document text
    • https://cdn.sqhk.co/moradivovep/eYAugfy/jofomipukexuluxan.pdfIn PDF document text
    • https://s3.amazonaws.com/zarusegibitumet/90376927537.pdfIn PDF document text
    • https://s3.amazonaws.com/jinabisura/deadpool_kills_the_marvel_universe_download_free.pdfIn PDF document text
    • https://s3.amazonaws.com/sigobija/android_ndk_folder_mac.pdfIn PDF document text
    • https://s3.amazonaws.com/nevowimo/evidence_based_practice_guidelines_for_sepsis.pdfIn PDF document text
    • https://s3.amazonaws.com/mijumomub/rubuxivavonojujug.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.