Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c1d851c345168a2…

MALICIOUS

PDF

88.7 KB Created: 2021-06-12 16:13:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: b4ee6c72ff5e61b0206275eb0fe25bef SHA-1: e1e805132486b610fa7074a3a85004c84df45a1c SHA-256: 4c1d851c345168a2dc72a1fb923a9e1e5bc143e278c322daff99e0daa69d8a2d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'https://archism.ru/pbw?utm_term=the+truth+of+stock+tape+pdf', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to stock trading, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6993

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://archism.ru/pbw?utm_term=the+truth+of+stock+tape+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4479223/normal_601b0f474a7d0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467325/normal_60378351d811d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4461485/normal_606ea1ae8627e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448558/normal_5fd64ec9dc931.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369646/normal_602c2c703c036.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454971/normal_5feafb543b936.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378378/normal_602e3e5a6e731.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4428035/normal_5fd13a131c527.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374196/normal_60bbb7aa644fa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383445/normal_6003f28dafaec.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372987/normal_5fcd42a3cd1f6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464524/normal_605b01161282b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470029/normal_605f5843a2a18.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53a9b73f-0700-4475-832a-8471c858b001/futakuguwoxaba.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/681e8a22-02bf-4d9c-bee7-d18b3420ac97/how_to_market_a_small_engine_repair_business.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e11a754f-cd6f-43c9-a00b-2979273c835c/xovumitofaw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ac0a101-9ab0-4325-87ad-067bb95b660f/sportdog_bark_collar_instructions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1404e1d-fb72-42ef-830a-d708bdb3f33f/best_youtube_channel_to_learn_english_from_hindi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/49262616-7994-4934-ab41-c88041f7ea9f/prelim_1_dressage_test.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9d0b2bd-2e76-4996-a04a-266dd65a0bbd/87970995001.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5cefd39f-7dcd-4c64-bf8d-e8876ebbd7ef/microsoft_excel_activities_for_high_school_students.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a65992f-8de4-4c2f-8d24-cbd52d449763/90817738339.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9609c9f9-db9a-4006-8b20-83089f46391b/xomifijesesu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b21f43b3-9b74-4e77-9d5d-d6be05e47a2a/82101563721.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/593f0992-e810-4f22-b0f5-ade8e9b64432/dell_optiplex_gx280_drivers_for_In PDF document text