Malicious PDF — malware analysis report

Static analysis result for SHA-256 5546bd6385bb2d0a…

MALICIOUS

PDF

80.4 KB Created: 2021-03-10 03:02:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: f7e37cb7a5e2cb216789b0fa3bf63dc3 SHA-1: 26872ed686ae62488753b05f23859f7e8e4cd5f2 SHA-256: 5546bd6385bb2d0a40a78f768ea8e5235d0df88643087288680344e3ab64b4aa
64 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a specific signature indicating it is a phishing trojan. The document body, though heavily obfuscated, contains text related to 'brand awareness mba project pdf' and is associated with the wkhtmltopdf application. A key indicator is the embedded external URI pointing to 'https://seumenha.ru/award?keyword=brand+awareness+mba+project+pdf', which is likely a phishing lure.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4924

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=brand+awareness+mba+project+pdf PDF link annotation
    • http://bitalotava.scienceontheweb.net/rexiwidusuloguzasepebis.pdfIn PDF document text
    • http://respect-ltd.su/39806742630uddbc.pdfIn PDF document text
    • http://dreabling.online/ejercicios_de_numeros_cuanticos_resueltoszi632.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417818/normal_5ff96c65f1bcc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4493245/normal_5fe9e2bcc6342.pdfIn PDF document text
    • http://valigulepi.scienceontheweb.net/english_grammar_class_12.pdfIn PDF document text
    • https://cdn.sqhk.co/dagozuwemep/4jyshfu/dunapimavoku.pdfIn PDF document text
    • http://jetinaxisodew.mypressonline.com/settlers_of_catan_development_cards_list.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490515/normal_60297c6c38637.pdfIn PDF document text
    • https://cdn.sqhk.co/nugilatunu/eaYbdqR/xiluvubogi.pdfIn PDF document text
    • http://nizavevorupuj.mywebcommunity.org/final_walk_through_and_closing_same_day.pdfIn PDF document text
    • https://cdn.sqhk.co/komajekolino/gFTjaje/kazunuzefoluzigokune.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390323/normal_6044a0754278d.pdfIn PDF document text
    • http://store50off.info/curso_de_direito_processual_civil_frg6bqw.pdfIn PDF document text
    • http://jerabigemoz.sportsontheweb.net/bodybuilding_program_for_mass_gaining.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403560/normal_5fe7879ca4a57.pdfIn PDF document text
    • https://s3.amazonaws.com/wujanozo/accomplishment_report_for_ojt_in_office.pdfIn PDF document text
    • http://supuwevul.atwebpages.com/kunigadenadikokulase.pdfIn PDF document text
    • https://s3.amazonaws.com/dazinibonofobi/how_do_i_know_if_my_refrigerator_compressor_is_working.pdfIn PDF document text
    • https://s3.amazonaws.com/xipavir/catalogo_de_cuentas_mexico.pdfIn PDF document text
    • http://gevejonitu.onlinewebshop.net/juego_de_mesa_una_noche_el_hombre_lobo.pdfIn PDF document text
    • http://kedisijusa.onlinewebshop.net/ziwix.pdfIn PDF document text
    • http://noroved.myartsonline.com/1242253216.pdfIn PDF document text
    • https://s3.amazonaws.com/tibanepoxilibud/robotica_carrera_informacion.pdfIn PDF document text
    • https://s3.amazonaws.com/sazixipame/how_to_use_countable_and_uncountable_nouns.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.