Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a26cd2a01f2e031…

MALICIOUS

PDF

134.9 KB Created: 2021-05-21 14:47:55 +03:00 Authoring application: Thomas Sims (via Mr. Dr. Keith Sanders) First seen: 2021-05-29
MD5: f1c2f6a45c7836cb41049df1693e724b SHA-1: 15eec98799f58d9271110e2b1fb48aadb3624aa1 SHA-256: 1a26cd2a01f2e031241a8cc6282e5ecdc1ae1837e68a381e2ebfb1b72b8b50dc
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical for phishing or malware distribution. It contains an embedded URI pointing to 'http://plhdluy.carenxt.com', which is likely the destination for the malicious payload or phishing page. The document's structure and heuristics strongly suggest it's designed to trick users into interacting with the external link.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3430

Heuristics 4

  • Image-only PDF carries local builder path plus remote links high PDF_IMAGE_LURE_LOCAL_FILE_AND_REMOTE_URI
    PDF is an image-only click lure that contains both remote HTTP(S) destinations and a file:/// URI exposing a local Windows/Linux builder path. That co-occurrence is not normal document linking; it matches generated clickbait/phishing carriers where the visible page is a screenshot and the clickable area sends the user to external infrastructure.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 134 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://plhdluy.carenxt.com PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.