Malicious PDF — malware analysis report

Static analysis result for SHA-256 455558353d28f570…

MALICIOUS

PDF

51.6 KB Created: 2020-12-02 10:46:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9bdfbc6b756b6e240b19db7dc4314b33 SHA-1: 2abd1942106eb6337f68febf3d4b6caba3b25990 SHA-256: 455558353d28f57089f8b91a0e304b49aa44df0116cab7b4dd6334e4bc3a6822
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ClamAV and an ML classifier. Heuristics indicate it's an image-only document designed as a lure, containing a clickable action that points to the URL 'https://traffine.ru/aws?utm_term=chinese+romance+movies+2017'. This suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7151

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 51 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?utm_term=chinese+romance+movies+2017
    • https://static.s123-cdn-static.com/uploads/4384628/normal_5fc4f30b44d42.pdf
    • https://radelemetiwiwi.weebly.com/uploads/1/3/4/5/134520029/vozoxo_nibogimuzi.pdf
    • https://cdn-cms.f-static.net/uploads/4380680/normal_5f8f5f3037d61.pdf
    • https://cdn-cms.f-static.net/uploads/4379219/normal_5f8ef2a271d8a.pdf
    • https://cdn-cms.f-static.net/uploads/4486975/normal_5fc2c1e24fdb0.pdf
    • https://cdn-cms.f-static.net/uploads/4449421/normal_5f9ed34c0f9a1.pdf
    • https://balomufe.weebly.com/uploads/1/3/4/5/134594694/8505748.pdf
    • https://jijajaxasivezix.weebly.com/uploads/1/3/4/5/134588510/8291621.pdf
    • https://cdn-cms.f-static.net/uploads/4410717/normal_5fbdd62e56a5c.pdf
    • https://wokesije.weebly.com/uploads/1/3/4/5/134597961/korogakomok_takaten_sifupapomisesol.pdf
    • https://cdn-cms.f-static.net/uploads/4413004/normal_5f93d15b68c3d.pdf
    • https://cdn-cms.f-static.net/uploads/4425933/normal_5f9c25e56447e.pdf
    • https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/d1ee3c84.pdf
    • https://uploads.strikinglycdn.com/files/791b5d8b-3aec-4a13-947b-8e16e93489ec/the_enlightened_one_buddha.pdf
    • https://uploads.strikinglycdn.com/files/11569db9-b941-4b2a-9198-3f3bda6bdf7f/xuzopexasesawoxirebek.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.