Malicious PDF — malware analysis report

Static analysis result for SHA-256 43c14b588bba9df7…

MALICIOUS

PDF

40.8 KB Created: 2021-03-27 18:59:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 54d457db6820bf21e4306e3e225f694c SHA-1: 10fca80a2619d7c452d50aab84d3f764262c4b18 SHA-256: 43c14b588bba9df7ec9846f0c69ca6d56f2099cfc9715a1c5cf9a546de119271
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file is identified as malicious by ClamAV and an ML classifier. It employs a common phishing tactic by presenting itself as an image-only document, likely a screenshot, to entice users to click on an embedded URI. The primary malicious URI identified is https://dugedepap.ru/award?keyword=l+adjectif+qualificatif+pdf, which is suspected to lead to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8221

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 40 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=l+adjectif+qualificatif+pdf
    • https://static.s123-cdn-static.com/uploads/4501486/normal_5fcdcc4729c40.pdf
    • https://cdn-cms.f-static.net/uploads/4471082/normal_604180d31fd50.pdf
    • http://rkconstructionsucks.com/tolojivetudkh6p.pdf
    • http://lubevos.scienceontheweb.net/bajusozejevunafol.pdf
    • https://cdn-cms.f-static.net/uploads/4452169/normal_60144715257c3.pdf
    • https://cdn-cms.f-static.net/uploads/4387933/normal_6038043a2cd8b.pdf
    • http://xagakojitogiva.getenjoyment.net/hp_officejet_pro_8600_plus_user_manual.pdf
    • https://cdn-cms.f-static.net/uploads/4471099/normal_5fd9c9c32241b.pdf
    • https://static.s123-cdn-static.com/uploads/4477373/normal_5ff5580b43128.pdf
    • http://laketofetujeso.medianewsonline.com/arm_microcontroller.pdf
    • http://expressvpn.store/download_death_tour_racing_action_gamef9zmp.pdf
    • http://luvabokinoleg.onlinewebshop.net/rhetorical_devices_meaning_chinese.pdf
    • http://rogofideb.onlinewebshop.net/beats_studio_wireless_headphones_noise_cancelling.pdf
    • https://uploads.strikinglycdn.com/files/42948682-4abe-4e8c-804a-fdbc6d4386da/how_not_to_pursue_a_man.pdf
    • https://uploads.strikinglycdn.com/files/ac33d3d1-b0c7-4d7f-b6f1-7f40b3982b60/3732212018.pdf
    • https://uploads.strikinglycdn.com/files/9d94dc1e-3394-4607-a01b-582cc2f4ece7/sat_writing_practice_prompts.pdf
    • https://uploads.strikinglycdn.com/files/c02fbef3-f3bb-45d5-9ab9-e9e0fd5ea412/33985216826.pdf
    • https://uploads.strikinglycdn.com/files/9887f96f-3021-4fd4-b7a4-b2ae1b893d35/zejodirodotonel.pdf
    • https://uploads.strikinglycdn.com/files/b1c9ff5a-095a-4057-9566-dada92d0ac67/dajipilemexakivex.pdf
    • https://uploads.strikinglycdn.com/files/cf65cfee-a881-423b-a5d5-98341035f87f/how_to_use_a_mophie_wireless_charging_pad.pdf
    • https://uploads.strikinglycdn.com/files/6558af80-b29d-470b-bd50-80c34ce34624/73066201886.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.