Malicious PDF — malware analysis report

Static analysis result for SHA-256 198f74c77bc82a5d…

MALICIOUS

PDF

38.7 KB Created: 2021-08-20 04:05:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: eeea829ab6367c69eeba60aa662cee0b SHA-1: 3e00d53ce4455c3f710f398a09e22fe11c10840c SHA-256: 198f74c77bc82a5d9df78becfe0429bc5166d68c3d380783bc2bf802ce36aeb4
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as a PDF containing embedded URLs, one of which is flagged as potentially malicious. The ClamAV detection 'Pdf.Phishing.Trojan' strongly suggests a phishing attempt. The presence of multiple unknown URLs further supports the likelihood of this document being used to distribute malware or lead users to phishing sites.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4199

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.auditsi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ba0156ec8ff---vigepo.pdf In PDF document text
    • http://dashoernerboot.de/userfiles/bevosaxivonife.pdfIn PDF document text
    • http://anhuifan.com/upload_fck/file/2021-4-28/20210428210418363429.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/PmAiG5ZyT-k/uplcv?utm_term=norma+iso+9001+vers%C3%A3o+2015+pdf+portuguesPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.