Malicious PDF — malware analysis report

Static analysis result for SHA-256 57430972eee116b2…

MALICIOUS

PDF

158.6 KB Created: 2021-05-29 18:03:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 375e3fc6615bad2a139781918f8b9b47 SHA-1: b2dd0b607943d0707ebc98f3ccde0730cfa1bb68 SHA-256: 57430972eee116b2162e96c6ed1c89d2c356728c1b34d9818270b498e58d04c2
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9908

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=diabolik+lovers+game+english+online PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4369643/normal_604f00247492b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366028/normal_5fd132b84376a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489240/normal_60183bd4a3ae4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445118/normal_6009f78889851.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485810/normal_60095a65d43f4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414500/normal_600ae1b76fbe5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370985/normal_5feafa60c82bb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417037/normal_5fcaa8795e4d0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374542/normal_5fcdc252998db.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4389606/normal_6006c5351ac79.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420029/normal_6066d73633d1f.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a806db59-ec22-42d7-868a-79719fe19edb/how_to_change_speed_on_segway_ninebot.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5cc3603-0de2-48e9-ba57-124716baefea/84330246607.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/28cc09c4-8b21-4167-a188-5f625709ad42/bexofigimelubizazut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aff695fd-f63e-46f1-9d1d-453da86de9e0/42953171283.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/65d05791-946c-4cca-a025-94fc7ca179fd/which_english_book_is_best_for_competitive_exams.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d2c6e7fa-29b8-4419-ba01-21b57f84f78d/what_is_visual_aids_in_teaching.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eda97696-6e04-46d0-b664-28825dc37447/nepepeg.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73c44be2-bdda-42ba-9115-69bc0554a6f9/verbos_regulares_e_irregulares_en_ingles_para_nios_de_primaria.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20917f7e-d6f0-4f8e-9406-61f3361c9808/what_can_you_watch_news_of_the_world_on.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2456578-8838-40b6-9dcb-f37540dedc37/bluetooth_share_folder_windows_10_to_android.pdfIn PDF document text