Malicious PDF — malware analysis report

Static analysis result for SHA-256 34298609cdd913f5…

MALICIOUS

PDF

50.6 KB Created: 2021-01-21 03:15:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14
MD5: 311534ab7d03b4704a7d0e1e69a0383e SHA-1: f78da55bb0149e6388ebd5850ca950b1b28a79ec SHA-256: 34298609cdd913f5f705388660186493ebe9239bea38a288b14254ceb1255931
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating it's a phishing trojan. The embedded URI points to a suspicious domain, likely intended to host a malicious payload or phishing page. Although no scripts were explicitly extracted, the PDF structure and the presence of an external URI suggest an attempt to trick the user into visiting a malicious site, likely as part of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9369

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?utm_term=analytical+reasoning+skills+pdf PDF link annotation
    • https://site-1168163.mozfiles.com/files/1168163/super_dancer_3_contestants_and_gurus.pdfIn PDF document text
    • https://site-1174133.mozfiles.com/files/1174133/muzoxironiku.pdfIn PDF document text
    • http://difavusimope.iblogger.org/31650935213.pdfIn PDF document text
    • http://kokilubowo.22web.org/4675037271.pdfIn PDF document text
    • http://sidumila.iblogger.org/30799864777.pdfIn PDF document text
    • http://patewukezevo.iblogger.org/komexosorapenikiloribufe.pdfIn PDF document text
    • https://s3.amazonaws.com/xujitezu/kvm_gpu_passthrough_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/gofilafixu/fusekuzogotov.pdfIn PDF document text
    • https://s3.amazonaws.com/tonisefoteka/kopanelewot.pdfIn PDF document text
    • https://s3.amazonaws.com/muxegeza/behringer_xenyx_1832fx_manual_espaol.pdfIn PDF document text
    • http://xuwabofori.epizy.com/storyboard_template_google_docs.pdfIn PDF document text
    • https://s3.amazonaws.com/mipizaju/dhamak_bass_song_djpunjab.pdfIn PDF document text
    • http://vobisobopimab.epizy.com/auditor_report_format.pdfIn PDF document text
    • http://kavotipuwevir.epizy.com/49642710633.pdfIn PDF document text
    • http://tujefozumuresul.epizy.com/cooker_hood_carbon_filter_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/fosagobomap/zakusijopenukodinijawen.pdfIn PDF document text
    • https://s3.amazonaws.com/nakevoja/rotalotidoratatawanerek.pdfIn PDF document text
    • https://s3.amazonaws.com/vavabi/34895386598.pdfIn PDF document text
    • http://pipinodojo.epizy.com/absolute_value_function_examples_with_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/wogikokuzotaxa/24377229488.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.