Malicious PDF — malware analysis report

Static analysis result for SHA-256 37d804f9eb6043b2…

MALICIOUS

PDF

47.5 KB Created: 2021-09-23 23:57:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23
MD5: 774a0dabd0fd2585a8af0af3c886b8e4 SHA-1: 1da65b9d0dddc375818313c6600dff5ae1f2ef54 SHA-256: 37d804f9eb6043b25dbf2d66e73aabfa8e6bae03ddcfcaf4b899a02304e06b83
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a signature indicating it is a phishing trojan. It contains embedded URLs, several of which are suspicious and point to PDF files hosted on potentially compromised websites. The PDF_URI heuristic also flagged an external URI, though its reputation is confirmed benign. The primary attack pattern involves directing users to malicious URLs, likely for phishing or further malware delivery.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4672

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://studioingegneriavaragnolo.com/userfiles/files/79486987018.pdf In PDF document text
    • https://hotel-la-licorne.fr/userfiles/file/wisarakamoloduxipozed.pdfIn PDF document text
    • http://toroisg.com/public/images/files/54103210443.pdfIn PDF document text
    • https://unibel.pl/pliki/upload/file/sikajemipin.pdfIn PDF document text
    • http://ballmillfactory.com/d/files/46588549379.pdfIn PDF document text
    • http://dnestrovsk.es-pmr.com/constructor/dnestrovsk/ckfinder/userfiles/files/vexuzIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/1xuhb7AK25c/uplcv?utm_term=how+to+save+battery+on+android+10PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.