Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e34a4a37ad5091c…

MALICIOUS

PDF

57.2 KB Created: 2021-03-14 20:56:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 84781a8402857e2f74bd18ef3e28bdbb SHA-1: 72639a60d09252d858a899a728ff21688d8ab83d SHA-256: 3e34a4a37ad5091c4ab1973721c497162054b416c3f2d74d477db4bef3d18014
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a lure related to "Warhammer bestiariusz pdf chomikuj" and embeds a URL pointing to a suspicious domain. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to redirect the user to a phishing or malware distribution site. No scripts were extracted, but the embedded URI is the primary indicator of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9477

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=warhammer+bestiariusz+pdf+chomikuj
    • http://fulukegoror.getenjoyment.net/10559778331.pdf
    • http://mazejofeg.mygamesonline.org/eimeria_tenella_life_cycle.pdf
    • http://jisutuxoxaza.medianewsonline.com/42955469147.pdf
    • http://ellmax-site.xyz/mitsubishi_tv_user_manual5hyd2.pdf
    • http://raisinslabs.club/likeg0hxgc.pdf
    • http://xamipofu.22web.org/the_raven_movie_2020.pdf
    • http://gijaninapumobe.sportsontheweb.net/jenegedetazugatuvike.pdf
    • https://s3.amazonaws.com/tinezedu/82174262130.pdf
    • http://faleferesevo.onlinewebshop.net/how_to_help_prevent_climate_change.pdf
    • http://wiwosotu.myartsonline.com/how_do_i_change_my_honeywell_thermostat_to_celsius.pdf
    • http://widifusi.myartsonline.com/mathematical_constants_finch.pdf
    • http://pulitisagot.atwebpages.com/install_driver_brother_mfc-8950dw.pdf
    • https://s3.amazonaws.com/tibanepoxilibud/pujidez.pdf
    • https://s3.amazonaws.com/kozibowisenatu/22950532450.pdf
    • http://saxarivoje.onlinewebshop.net/dupenixavep.pdf
    • http://punexowimuseva.epizy.com/vaults_of_atziri_guide.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.