Malicious PDF — malware analysis report

Static analysis result for SHA-256 59dde41c99e0f09b…

MALICIOUS

PDF

42.3 KB Created: 2020-11-13 23:47:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: e45b1e7d2f232c111e79b0386a16558e SHA-1: 2529842946ee79b2dcc7aa97ea449fa187700b61 SHA-256: 59dde41c99e0f09bb7353e3f237b952fd93505694d84c41f5ccba4e321bc7803
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7109

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/strik?utm_term=piqure+de+poux+sur+le+corps PDF link annotation
    • https://mupibidegupek.weebly.com/uploads/1/3/0/8/130874042/1890735.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386618/normal_5f8d6d2fd68a3.pdfIn PDF document text
    • https://wovuxekas.weebly.com/uploads/1/3/4/3/134379471/31d6a9b799.pdfIn PDF document text
    • https://xogupugisi.weebly.com/uploads/1/3/4/1/134109029/3445079.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402032/normal_5f95f59008317.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449614/normal_5fa0b4e7e7613.pdfIn PDF document text
    • https://dubuzosokiboxof.weebly.com/uploads/1/3/1/1/131163723/takuluge.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448110/normal_5fa5309d90a87.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426543/normal_5f9c1796a6db6.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01080449-1040-47c0-ad4e-2ce7ea00cf53/when_was_the_color_purple_first_banned.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d7874471-0c26-4de7-90fe-3234d40fa847/fidosas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06b2e884-f6c1-4634-8005-1187ac077a59/vidonifosawumupi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/164e8eec-aa53-4389-82b0-8ecf2e664301/50058319470.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.