Malicious PDF — malware analysis report

Static analysis result for SHA-256 18d1e929d8b61ed9…

MALICIOUS

PDF

52.6 KB Created: 2021-03-10 02:33:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9a187f91e2afaa61d22824e67d40cc1c SHA-1: 27cedff62c4de2ab2f013c6d2efaa83dfac36aa9 SHA-256: 18d1e929d8b61ed97dcd389f18d395faaf88e9aff75cd81c85a7dbc1e18d2872
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file is identified as malicious by ClamAV and an ML classifier. The 'PDF_IMAGE_LURE' heuristic indicates it's an image-only document designed to trick users into clicking an embedded link, likely for phishing or to download a second-stage payload. The primary external URI found is https://leonvi.ru/aws?utm_term=cheap+125cc+road+legal+dirt+bikes+for+sale.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7391

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 52 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/aws?utm_term=cheap+125cc+road+legal+dirt+bikes+for+sale
    • https://lusenivusimutom.weebly.com/uploads/1/3/4/8/134887898/tesabedunus.pdf
    • https://risidetumul.weebly.com/uploads/1/3/4/3/134320066/sutojapedanafagozum.pdf
    • http://igbusinessabouthelp.com/3427740556mutfx.pdf
    • http://alifan.store/585444316296kruq.pdf
    • http://circus.market/losofunafawanadetovuxw2he6.pdf
    • https://dorikorojuj.weebly.com/uploads/1/3/3/9/133987202/lomekodosukewiwutoja.pdf
    • https://sobasoje.weebly.com/uploads/1/3/2/6/132695832/naxoxix.pdf
    • http://revershjtb.site/libro_de_fisica_1_bachillerato_tercer_semestre_contestadooqfim.pdf
    • http://wusejopajaxus.22web.org/cannondale_habit_2016_manual.pdf
    • https://penebiji.weebly.com/uploads/1/3/5/3/135346042/9880388.pdf
    • https://uploads.strikinglycdn.com/files/9c860185-13a5-40e2-9eea-ce1ea74a11ac/31033633830.pdf
    • https://s3.amazonaws.com/nufidibodudulad/36928339128.pdf
    • https://s3.amazonaws.com/zesotat/nintendo_64_emulator_unblocked.pdf
    • http://mafakizukizunof.epizy.com/zemonuwosekutej.pdf
    • https://uploads.strikinglycdn.com/files/ad658c51-ba02-4b27-a4b5-defec579239a/winixowowajexutamo.pdf
    • https://uploads.strikinglycdn.com/files/f8d5c85f-8dd6-41f1-8211-720dc36b6829/what_is_the_most_potent_acid.pdf
    • http://borinalujid.epizy.com/1413436761.pdf
    • http://gidepajujida.rf.gd/frp_bypass_apk_samsung_j5_prime.pdf
    • http://rodobokojezaga.epizy.com/nuzumewujafexakan.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.