Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ef0098fb45a4638…

MALICIOUS

PDF

50.6 KB Created: 2020-11-20 16:33:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 5fb418c870235a18b213a7a0940e0198 SHA-1: 5cde658fdc3ad5813afb6cd9d20bac3bc91e8ffa SHA-256: 1ef0098fb45a4638c6d10c41a195100bc1e3a67d20ad76ff1277ea84cfd1fd9f
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF document that contains an embedded URL. Heuristics indicate this URL is malicious and the document has been flagged by ML classifiers and ClamAV as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to an allergy report, likely to trick the user into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6469

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/aws?utm_term=dallas+allergy+report+mold PDF link annotation
    • https://nukuzalidoredul.weebly.com/uploads/1/3/4/7/134768970/leregoforutubimexo.pdfIn PDF document text
    • https://roxoxurapu.weebly.com/uploads/1/3/4/3/134307884/4960639.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382781/normal_5faa0e2a65ea1.pdfIn PDF document text
    • https://fuparududewon.weebly.com/uploads/1/3/1/8/131856041/jovirojutem.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460946/normal_5fa4593bf33f4.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3908ad2c-ef99-4159-90c7-48a3008f7f98/74869923825.pdfIn PDF document text
    • https://s3.amazonaws.com/vuxagixil/53414029824.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a07c1933-bef5-4e76-86bf-39a113d0d291/bekudolojefitujigekewav.pdfIn PDF document text
    • https://s3.amazonaws.com/salosibejodod/48682868171.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.