Malicious PDF — malware analysis report

Static analysis result for SHA-256 29e02f072c8349e8…

MALICIOUS

PDF

61.3 KB Created: 2021-03-15 16:36:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6ace4ee3f1907e9a53b5fa31ce3750e0 SHA-1: 26559b0dba8b5e8e5de23cbf30f4cb419244766e SHA-256: 29e02f072c8349e8b81616d2deb31485ccb49ec21ad6678e3d1f60453039f861
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into visiting a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'organelos celulares pdf unam'. No scripts were extracted, but the presence of an external URI and the nature of the ClamAV detection point towards a phishing or trojanized PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6421

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=organelos+celulares+pdf+unam
    • http://gopadaxin.mywebcommunity.org/anisocorie_etiologie.pdf
    • http://arevakar-travel.com/693051222213549v.pdf
    • http://supermagazforsale1.xyz/watezukogojax4gyig.pdf
    • http://gudokav.sportsontheweb.net/puwuwin.pdf
    • http://sosuziba.mypressonline.com/80300500616.pdf
    • http://firstreadersclub.com/what_did_galileo_discover_about_falling_objectsph9zi.pdf
    • http://vubopukupera.22web.org/lajosusasujimabid.pdf
    • http://bimoriz.getenjoyment.net/scag_cheetah_mowers_reviews.pdf
    • http://whitecheat.xyz/cherokee_flexibles_uniformsg9n1w.pdf
    • https://s3.amazonaws.com/dubiditiginowo/lokikavewegafutowovuzape.pdf
    • http://sidepojedava.myartsonline.com/stihl_hs80_hedge_trimmer_review.pdf
    • https://s3.amazonaws.com/rubidokezive/tolivezozumarokiwodivosu.pdf
    • http://fumibilulad.atwebpages.com/tipos_de_antibiograma.pdf
    • http://kujujigufa.epizy.com/jasogisudaxetolamul.pdf
    • https://s3.amazonaws.com/tobovunoberiki/lofoten_islands_travel_guide.pdf
    • http://lavavoju.rf.gd/kagokilejiduretominevakop.pdf
    • http://tevoxuvi.rf.gd/genufatoxolekobogalapa.pdf
    • https://s3.amazonaws.com/bededuxotulapil/xuxupife.pdf
    • http://jorowiwiboxizuk.rf.gd/model_boat_building_plans.pdf
    • https://s3.amazonaws.com/murudute/batching_plant.pdf
    • https://s3.amazonaws.com/vuxirefare/articles_of_incorporation_nc_form.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.