Malicious PDF — malware analysis report

Static analysis result for SHA-256 301a720e25e9d5c9…

MALICIOUS

PDF

50.6 KB Created: 2021-01-21 16:55:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fd89b7b47e3f4a97762eb8d7fc84bb28 SHA-1: e5393a99ef6b7f84a8a1af19469097a7f7e5a00a SHA-256: 301a720e25e9d5c995e37e5419c824b7c8881ed9853b165df8babd7eb059fc99
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains an embedded URL that redirects to a malicious domain, as indicated by multiple heuristic firings and ClamAV detection. The document body, though heavily obfuscated, appears to be a lure related to 'Calcite formation boxwork' to entice users to click the malicious link. No scripts were extracted, but the presence of external URIs and the ML classifier output strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8547

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/aws?utm_term=calcite+formation+boxwork
    • https://lalidusuferub.weebly.com/uploads/1/3/4/4/134440540/0daec2b4.pdf
    • http://rabisoluvilava.iblogger.org/19102766925.pdf
    • https://mujolimu.weebly.com/uploads/1/3/4/8/134868529/modezax.pdf
    • https://static.s123-cdn-static.com/uploads/4481162/normal_5fe5dce95e9b5.pdf
    • https://tepidupelagoxu.weebly.com/uploads/1/3/4/4/134472529/3088928.pdf
    • https://site-1168481.mozfiles.com/files/1168481/48823906530.pdf
    • https://static.s123-cdn-static.com/uploads/4381541/normal_5ff64b245c321.pdf
    • http://ranomurivokav.22web.org/78090942151.pdf
    • https://site-1174172.mozfiles.com/files/1174172/download_lagu_big_bang_loser_mp3_matikiri.pdf
    • https://site-1211821.mozfiles.com/files/1211821/vertigo_attack_when_waking_up.pdf
    • https://cdn.sqhk.co/pixazizaze/7ggjrXJ/kodiak_weather_radar.pdf
    • https://static.s123-cdn-static.com/uploads/4448545/normal_5ffbe58eeaeae.pdf
    • https://sodefabufu.weebly.com/uploads/1/3/4/4/134473286/0e82a95.pdf
    • https://static.s123-cdn-static.com/uploads/4459914/normal_600807c881c1c.pdf
    • https://static.s123-cdn-static.com/uploads/4480387/normal_5ff93f2af38f3.pdf
    • http://zusobudem.epizy.com/nodinano.pdf
    • http://xovijoj.epizy.com/74809086575.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.