Malicious PDF — malware analysis report

Static analysis result for SHA-256 449be53dd83181b6…

MALICIOUS

PDF

49.6 KB Created: 2020-11-13 06:12:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a9acc147b9921c5daf9f2ff7207104a2 SHA-1: 12d5d540a2f535b489adaa734e496579392f9bef SHA-256: 449be53dd83181b6d85072e2975128ac89210c3d8934a7965063670feb93a12a
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ClamAV and an ML classifier. It employs an image-only lure, typical of phishing, with a clickable action pointing to an external URL. The document body, though heavily obfuscated, contains references to 'Android 8.0.0 root no pc', suggesting a lure related to device rooting or exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6064

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 49 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=android+8.+0.+0+root+no+pc
    • https://cdn-cms.f-static.net/uploads/4371023/normal_5f8fd1f25379f.pdf
    • https://letitelow.weebly.com/uploads/1/3/4/5/134500939/dulube.pdf
    • https://sorimuzumetig.weebly.com/uploads/1/3/4/5/134519591/47349625da.pdf
    • https://mapipuluzobeb.weebly.com/uploads/1/3/1/3/131398440/debajonisus.pdf
    • https://labuxodapiju.weebly.com/uploads/1/3/4/4/134492440/10a8e0c04.pdf
    • https://uploads.strikinglycdn.com/files/0c246a2d-94f8-43e8-a43e-e2516e4581a9/65121965980.pdf
    • https://uploads.strikinglycdn.com/files/384e7fdb-36af-4cda-83bf-608248ccca85/kuwel.pdf
    • https://uploads.strikinglycdn.com/files/e19ca3e9-8aae-41bd-a7a1-dd1fd92e0cd5/95611376598.pdf
    • https://uploads.strikinglycdn.com/files/907fefc6-b0c5-4833-9d26-c15010fb7531/947662481.pdf
    • https://uploads.strikinglycdn.com/files/e8f423b2-5ace-47bb-bb0a-e75ffcf1db44/bapizuwajiw.pdf
    • https://uploads.strikinglycdn.com/files/4c7f0bea-a6b4-4b8c-a76a-f85980978627/bivuseg.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.