Malicious PDF — malware analysis report

Static analysis result for SHA-256 58356bb37b449d12…

MALICIOUS

PDF

50.6 KB Created: 2020-12-28 08:40:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: dcba158aee6f42bbac377af2104e53b1 SHA-1: a6661ec74a46f07d9a7cfcbb7cdf89f92379ce64 SHA-256: 58356bb37b449d12e8aa81e3dabc8d7b0432a252b3715a08982bab503b01b72d
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of the 'SE_PASSWORD_ARCHIVE_LURE' heuristic suggests the document is designed to trick users into opening a password-protected archive, a common tactic for evading gateway security. The embedded URL points to a suspicious domain, likely serving as a download source for the secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8547

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?utm_term=autocad+isometric+drawing+tutorial+pdf PDF link annotation
    • https://cdn.sqhk.co/fuluzezufe/f2JH5jg/complete_math.pdfIn PDF document text
    • https://cdn.sqhk.co/lasesekov/gdFdosZ/barrett_jackson_vegas_2020_dates.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459323/normal_5fd9e216580a9.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/39604de4-c085-4e5a-b2c7-c27198f4db13/89583760139.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bfda13ec-5c84-4833-a9c5-c09a34f20c13/nitaridevaradepumetepa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5f5eb6d-3711-4e09-8fbd-5f7b647b7c72/70067368446.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/832c865e-26ed-48fe-b0bc-c89fd3414c74/96274232730.pdfIn PDF document text
    • https://s3.amazonaws.com/buponuwebi/din_en_iso_2409_gitterschnittprfung.pdfIn PDF document text
    • https://s3.amazonaws.com/xijalovelokolep/wapavik.pdfIn PDF document text
    • https://s3.amazonaws.com/lunojol/video_er_lite_app_store.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/653d8a6d-604f-49c9-a189-e930a416c01d/69117875016.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4477c76-265a-48ee-b844-3d0e92362cea/winrar_password_remover_online.pdfIn PDF document text
    • https://s3.amazonaws.com/dinisemowoge/44263752086.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2b651d8-6e2d-4825-96fa-e0a5e7d71152/download_halo_unblocked.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb7b833f-2cae-4fb6-8d86-590da7a02f2f/bavojodovopikezenir.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/971afece-d01c-47c4-8d5f-5231d8e54926/arizona_business_management_study_gu.pdfIn PDF document text
    • https://s3.amazonaws.com/sazariwapa/nowafixiwomonunuvatek.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.