PDF malware analysis — malicious · 3059518591a740ff

MALICIOUS

PDF

39.4 KB Created: 2021-03-25 14:25:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7a246f7231f1dc466c56f3920a17782f SHA-1: bf4306d73fb266298f27fd677e265f57a5689f99 SHA-256: 3059518591a740ffce6980fb3e2d4dc77ad2c70dc142dd4becaa0835c8db7321

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as a phishing lure due to its image-only nature and a clickable action triggering an external URL. The embedded URL, https://crophysi.ru/award?keyword=converter+pdf+to+word+document+which+is+editable, is the primary indicator of malicious intent, likely leading to a phishing page or a malware download. ClamAV and ML classifiers also flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.7452

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 39 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crophysi.ru/award?keyword=converter+pdf+to+word+document+which+is+editable
- http://zexaribamemavi.sportsontheweb.net/51091183377.pdf
- https://nafipitomaw.weebly.com/uploads/1/3/5/3/135349771/fojibutijexanegi.pdf
- https://vesukinixemijuw.weebly.com/uploads/1/3/2/6/132696016/pejer_kusabafamij.pdf
- https://memuwumobodedo.weebly.com/uploads/1/3/5/9/135974490/3053877.pdf
- http://fujigukatujewu.medianewsonline.com/rainsoft_water_filter_parts.pdf
- http://wozekozexufoxol.scienceontheweb.net/58482633927.pdf
- https://nezozavigarej.weebly.com/uploads/1/3/4/7/134727028/wimozenakak.pdf
- https://31c8a3d4-0132-49f1-a04f-09c79d03e01f.filesusr.com/ugd/a4da84_eb398dc06080401e90ced2b9e6e42053.pdf?index=true
- https://s3.amazonaws.com/jezaxojipevu/kudapa.pdf
- https://s3.amazonaws.com/sifawekujiki/79788133717.pdf
- https://s3.amazonaws.com/fowikorejodi/hp_motherboard_list.pdf
- https://s3.amazonaws.com/sebunuzu/critical_ops_apk_data_apkpure.pdf
- https://f459ab6e-ac57-43ce-b83a-1524846427e4.filesusr.com/ugd/938c70_9907abec59ac42fe952b9411cd92222c.pdf?index=true
- https://832c8a8d-f05d-46e3-9166-97d9de82ace4.filesusr.com/ugd/432509_f5343b9329ec4b2a8bd02eb0d8889c8c.pdf?index=true
- https://959e49da-b405-4961-97d4-5c1bb2e9a628.filesusr.com/ugd/ab0441_fe241d99a42b4d118d5ef81c80e66efb.pdf?index=true
- https://aa514bbb-a96e-4bc9-8ff3-0ca2edd1104f.filesusr.com/ugd/3fc21f_efe7b2a701e14e5988f4bdb7a0a2a82f.pdf?index=true
- https://s3.amazonaws.com/rorives/how_to_program_esp8266_12e_using_arduino

Open this report in the interactive analyzer, or submit your own file for analysis.