Malicious PDF — malware analysis report

Static analysis result for SHA-256 22eeffe6a6cdd150…

MALICIOUS

PDF

46.2 KB Created: 2021-04-04 08:34:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: db335e202cf3e6beb967c905b253bcda SHA-1: 17f83ebb5e104ae7d8f123ed11238764022c2209 SHA-256: 22eeffe6a6cdd1505843d4b87a5349d05de0f444c8c4a4c7383188d6945e3688
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ClamAV and an ML classifier. It employs an image-only lure, typical of phishing, with a single embedded URI pointing to 'https://baarspo.ru/award?keyword=the+playbook+barney+stinson+pdf+espa%25C3%25B1ol+mega'. The document's structure and the presence of external links suggest an attempt to redirect the user to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7134

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 46 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=the+playbook+barney+stinson+pdf+espa%25C3%25B1ol+mega
    • https://cdn.sqhk.co/bamebuxi/gk0Ejf1/free_red_and_blue_background_images.pdf
    • http://copyright-services-us.com/51624718597mbsoj.pdf
    • http://nowuzoti.iblogger.org/63613797392.pdf
    • http://sokobumoxagug.scienceontheweb.net/hoerner_aerodynamic_drag.pdf
    • http://usacarins.com/does_better_business_bureau_do_anythingszxtb.pdf
    • http://ditoterelutas.sportsontheweb.net/chemical_bonding_short_notes.pdf
    • http://lazadacostumercenter.com/deltran_battery_tender_plus_near_mecs1d9.pdf
    • http://bonifacy.site/29886622249nfz0g.pdf
    • http://vasuxarogaxatix.iblogger.org/wound_care_education_institute.pdf
    • https://cdn.sqhk.co/dikapagoloza/UShjfgd/moto_rider_go.pdf
    • https://cdn.sqhk.co/rotonoba/igqxchi/39344157115.pdf
    • https://uploads.strikinglycdn.com/files/8b2c2ba9-2d18-4e52-a584-3e33ed67d91e/nobijisaragaxatage.pdf
    • https://uploads.strikinglycdn.com/files/ddbb055a-0994-4421-8ccb-7ad4ea581eda/ranoroj.pdf
    • http://misukejijixuke.epizy.com/nosetukikimafarujavabipe.pdf
    • https://uploads.strikinglycdn.com/files/fe2d8e11-3df2-45c7-8329-6642b4d6d344/plc_programming_courses_online_uk.pdf
    • https://uploads.strikinglycdn.com/files/87c396f6-bec7-4be2-be02-323c3a05b7c5/rerudurik.pdf
    • https://uploads.strikinglycdn.com/files/1549e813-fce3-430d-9f1e-7f2d88b3b51d/76632648437.pdf
    • https://uploads.strikinglycdn.com/files/a9a21acb-560d-4546-a52e-0cc5f7785147/tozaxoxozogidetexobino.pdf
    • http://sifusavukaga.rf.gd/58771023087.pdf
    • http://zojofat.epizy.com/povapawelovezakuguxuleji.pdf
    • http://nopugorib.onlinewebshop.net/43715563654.pdf
    • https://uploads.strikinglycdn.com/files/e6daddf1-e849-417d-a2b0-aa6b0c21ee2a/boss_gt_1000_core_price.pdf
    • http://tibamupebunod.atwebpages.com/rebifap.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.