Malicious PDF — malware analysis report

Static analysis result for SHA-256 58f52ba8815b5478…

MALICIOUS

PDF

61.2 KB Created: 2021-03-26 10:19:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 82c7b22ed05c5a24e270173669f890de SHA-1: ab6fac5d63a78e93cace559bc3714ef6536b60d9 SHA-256: 58f52ba8815b5478b95e123abccbf228b4300dff0366bad147468f56212a7418
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ML classifiers and ClamAV, exhibiting characteristics of a phishing lure. The heuristic PDF_IMAGE_LURE indicates it's an image-based document with a clickable action, likely designed to redirect users to malicious URLs. The embedded URL https://mezovuduw.ru/strik?utm_term=why+dogs+are+good+pets+essay is a primary indicator of this phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5491

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 61 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=why+dogs+are+good+pets+essay
    • http://my-favshopg.online/tangram_puzzles_freegvf0m.pdf
    • https://cdn-cms.f-static.net/uploads/4420476/normal_603f19af36bd7.pdf
    • http://edapog.online/netflix_android_apk_xda7tnlt.pdf
    • https://cdn-cms.f-static.net/uploads/4374359/normal_600c5387b4bbd.pdf
    • https://cdn-cms.f-static.net/uploads/4384307/normal_602c14b67dd54.pdf
    • http://rozewevojalel.sportsontheweb.net/theorems_of_boolean_algebra.pdf
    • https://static.s123-cdn-static.com/uploads/4370744/normal_5ff8c7876be65.pdf
    • https://cdn-cms.f-static.net/uploads/4390328/normal_601c7024d0e3c.pdf
    • https://cdn-cms.f-static.net/uploads/4372721/normal_6011dfcb52213.pdf
    • http://wiinorama.space/pyramid_principle_presentation_templatemn02i.pdf
    • https://cdn-cms.f-static.net/uploads/4413363/normal_601978790b6ed.pdf
    • http://pekibexuvipeve.scienceontheweb.net/sajawemazurowa.pdf
    • http://kudikadip.getenjoyment.net/dusomojukim.pdf
    • https://cdn-cms.f-static.net/uploads/4464301/normal_6010c644caf78.pdf
    • https://static.s123-cdn-static.com/uploads/4383698/normal_5fccf65d88f25.pdf
    • https://cdn-cms.f-static.net/uploads/4393189/normal_60362d9273158.pdf
    • http://tvoyoproc.fun/51978923378kh18a.pdf
    • https://cdn-cms.f-static.net/uploads/4401989/normal_6031302f93e76.pdf
    • https://s3.amazonaws.com/remufuzu/97614488804.pdf
    • https://s3.amazonaws.com/gonasidupij/pawimodajagot.pdf
    • http://wikukodukoja.onlinewebshop.net/workpro_quantum_9000_series_replacement_parts.pdf
    • https://s3.amazonaws.com/nasitevu/teacher_assistant_interview_questions_and_answers.pdf
    • https://s3.amazonaws.com/vixuwogetiv/canada_food_guide_2019.pdf
    • https://s3.amazonaws.com/bawalidamovidud/tozuwiz.pdf
    • http://desujiruvomeb.myartsonline.com/negoduwewa.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.