Malicious PDF — malware analysis report

Static analysis result for SHA-256 49174daedcbc6ce3…

MALICIOUS

PDF

54.3 KB Created: 2021-03-29 22:26:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ce9771330dd41ffeb9aee873bfed043c SHA-1: d4eb1f15dd750ea717ddb64cb2d8d239d01d1dc9 SHA-256: 49174daedcbc6ce34382226a3a773b69d44aa4f447f1d9b63f27f0a3d767192e
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ClamAV and an ML classifier. It employs a common phishing tactic by presenting a screenshot as the document content, with an embedded URI that likely leads to a malicious site. The heuristic 'PDF_IMAGE_LURE' confirms this approach, indicating the document is designed to trick users into clicking through to an external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8115

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 54 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=calcolo+cemento+armato+pdf
    • http://zizaburixakog.iblogger.org/46271671376.pdf
    • http://leledup.mypressonline.com/all_formula_of_electrical_engineering.pdf
    • http://grinallex.shop/bekhayali_ringtone_male_version88fg1.pdf
    • http://medicinfo.online/nexelinakc8kre.pdf
    • http://pazanufedaf.22web.org/mass_effect_andromeda_prima_guide.pdf
    • http://zilijakal.iblogger.org/guzanarume.pdf
    • http://kagabefusexem.epizy.com/16282490392.pdf
    • https://s3.amazonaws.com/kisimujuk/how_to_write_a_user_story_description.pdf
    • http://mumositu.epizy.com/76570788344.pdf
    • https://74fc1a11-d445-4ffb-bc6b-7a79e5a65a18.filesusr.com/ugd/097bd5_5667e4f2fa00452c93de3c6fd60e9df2.pdf?index=true
    • https://38a589f5-619b-4230-bc7d-f88d9fc6dac5.filesusr.com/ugd/392051_cab116be8d464aaaa3473688e81336ee.pdf?index=true
    • https://s3.amazonaws.com/wemazun/11131074994.pdf
    • https://s3.amazonaws.com/zidosozawok/cleopatra_movie_free.pdf
    • http://lefarobi.rf.gd/63040358482.pdf
    • http://duposavolat.rf.gd/23292173201.pdf
    • http://kuzojepume.epizy.com/82563167241.pdf
    • https://5e04165b-6ab1-49a6-9937-45006fc2fbeb.filesusr.com/ugd/d19879_9a9cf31124ae428eab6de25ee0a7cc12.pdf?index=true
    • https://s3.amazonaws.com/tanapilamaxi/93279191527.pdf
    • http://lamupimifuban.onlinewebshop.net/geselabuvovegaduji.pdf
    • https://s3.amazonaws.com/zuniverijesud/50651543.pdf
    • http://supuwevul.atwebpages.com/amana_microwave_light_bulb.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.