Malicious PDF — malware analysis report

Static analysis result for SHA-256 244b2fa29241a018…

MALICIOUS

PDF

57.0 KB Created: 2021-06-07 23:46:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a643a9b75e2548e87fce776342efbda4 SHA-1: 0e5397fea8c4665eec7754f865f9ad64c074c34b SHA-256: 244b2fa29241a0186d87ae6f0f1f287fd6f5aa17cd8f1ad92b081768dabe7d88
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'catamma.ru' suggests the document is designed to redirect users to a potentially harmful website. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9915

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/uplcv?utm_term=cribriform+plate+types+ct
    • https://ancoraeducacion.com/images/zixeluwo.pdf
    • https://www.hdontheroadnapoli.it/wp-content/plugins/formcraft/file-upload/server/content/files/1608d4720aa086---8619594797.pdf
    • http://talleresjpg.es/img/file/ronoro.pdf
    • https://siyata.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/160b614950515a---38945869120.pdf
    • http://www.gunyagder.org.tr/wp-content/plugins/super-forms/uploads/php/files/5djnjrip4kak6f3fvlgrujvr70/64777676258.pdf
    • http://aberdeeneyes.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16074bab6b688e---xomumagalorululejugirijof.pdf
    • https://artbynela.com/uploads/file/39632477798.pdf
    • https://www.chauffeur-prive-nice.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1606f035b5f6cc---pojelisaxurozoku.pdf
    • https://www.spoton.pet/wp-content/plugins/super-forms/uploads/php/files/fuuvkic6bgb3ofsgihi84fvt0i/segujodagilukaxomo.pdf
    • https://www.jahnigterbraak.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a6d83967ce6---36225004984.pdf
    • http://alituncer.com/userfiles/file/21229687191.pdf
    • https://tripleccompanies.com/wp-content/plugins/super-forms/uploads/php/files/3e688034115f8412a22e6ec88828e6ef/jijumuruxovajakatawim.pdf
    • https://alakharia.com/public_html/userfiles/file/30293546038.pdf
    • http://xn--b1agjlwjc3g.xn--p1ai/ckfinder/userfiles/files/1342342626.pdf
    • http://www.cascinasorigherio.it/wp-content/plugins/formcraft/file-upload/server/content/files/160a8d572d6dac---pewosivuxixo.pdf
    • https://michaels-limo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c60bc92a9e---48677943786.pdf
    • https://premiumvipbusiness.com/wp-content/plugins/super-forms/uploads/php/files/dadd33695e2ecbb46d9cd81930cf8998/buxedolu.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.