Malicious PDF — malware analysis report

Static analysis result for SHA-256 3cdbc4db77e90ea5…

MALICIOUS

PDF

50.6 KB Created: 2021-03-09 18:37:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 257819e737dc67b64213d70df0e25dc4 SHA-1: 3bd06df9eb7b5bcb801be3378d4b353ac4b8135e SHA-256: 3cdbc4db77e90ea563fc2a6349c44f21034bd9153796982c7dd8004f0751f851
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a phishing lure due to its image-only nature and embedded clickable action. The primary malicious URL, https://gimoguvi.ru/aws?utm_term=xbox+live+gold+codes+free+reddit, is likely used to redirect the user to a malicious site. While no scripts were explicitly extracted, the PDF structure and heuristic firings suggest it's designed to exploit user interaction for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/aws?utm_term=xbox+live+gold+codes+free+reddit
    • http://rameautbxy.space/zuvoni2d19w.pdf
    • http://hookup671.site/tetowojobidolunart7hz.pdf
    • http://lnstgramhelpcopyright.com/how_to_find_ip_address_subnet_mask_and_default_gateway_windows_10zo2vw.pdf
    • http://lnstagramlivesupportcenter.com/sejozamabuditulexis2ei4n.pdf
    • http://gedatidigog.sportsontheweb.net/54866770931.pdf
    • http://didazema.mypressonline.com/lubewimazomilabatikine.pdf
    • http://zomoxoxuriw.mypressonline.com/canon_650d_manual.pdf
    • http://lomuwugevona.getenjoyment.net/what_is_expense_reimbursement_revenue_in_real_estate.pdf
    • http://merishwheelrecords.com/tajunodumijivuh8ad6.pdf
    • http://jaxagogilexet.sportsontheweb.net/adobe_acrobat_dc_ocr.pdf
    • https://s3.amazonaws.com/girilifawuxi/28873669622.pdf
    • https://uploads.strikinglycdn.com/files/ec5a8aa5-f54e-43b6-b5e5-32493aff608b/93089737070.pdf
    • https://s3.amazonaws.com/xukonakefules/synonyms_and_antonyms_for_informant.pdf
    • https://uploads.strikinglycdn.com/files/fcba91a4-80cb-49d4-84e6-af23fb64bef5/gimp_leg_gif.pdf
    • https://uploads.strikinglycdn.com/files/75d2269a-6b5c-4667-9015-d5047691132f/54002221326.pdf
    • https://uploads.strikinglycdn.com/files/7f2a0603-f002-4c03-ae8e-b6090013b181/bugusumusikekabebabiw.pdf
    • http://fojakosi.atwebpages.com/clicker_universal_keypad_reprogram.pdf
    • https://uploads.strikinglycdn.com/files/177e02d2-bcc3-4694-b533-2c55d44a837c/90750864968.pdf
    • https://uploads.strikinglycdn.com/files/c9b12cf0-793b-461c-afdc-4ea8def71066/94664306273.pdf
    • https://uploads.strikinglycdn.com/files/17a6344c-524d-4726-8236-e6d8d988244f/vitovajikaluzerisaxev.pdf
    • https://s3.amazonaws.com/kaxukok/31144828058.pdf
    • https://uploads.strikinglycdn.com/files/ffbc3436-3c13-4353-9266-e4ab6150ff37/sharp_carousel_convection_microwave_oven_user_manual.pdf
    • https://uploads.strikinglycdn.com/files/501638ab-ae2d-4771-88da-cc66ada4029a/52985417051.pdf
    • https://uploads.strikinglycdn.com/files/d1ea73a1-76df-42fa-b126-fef664672341/navy_terminal_leave_policy.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.