Malicious PDF — malware analysis report

Static analysis result for SHA-256 6677f98ba02a1c99…

MALICIOUS

PDF

62.7 KB Created: 2021-03-17 15:33:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6edea5b1e89fdd075feddb64ab9a6020 SHA-1: 16a36fdd77638c4774109834347adbe15d1adc90 SHA-256: 6677f98ba02a1c99244d82c588cce7c366d89a8ae97a6410a82ab10fbdbae8cb
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains an embedded URI pointing to a suspicious domain, which is highly indicative of a phishing or malware distribution attempt. The ClamAV detection and ML classifier further support its malicious nature. The document body, though heavily obfuscated, contains keywords related to downloading accreditation instruments, suggesting a lure to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5346

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=download+instrumen+akreditasi+puskesmas+2020+pdf
    • http://nout-prodat.site/jamaica_radio_station_rjr_94_fm3unfm.pdf
    • https://cdn-cms.f-static.net/uploads/4501961/normal_60467336256c8.pdf
    • https://cdn-cms.f-static.net/uploads/4445880/normal_60117e4045e3d.pdf
    • https://cdn.sqhk.co/xawobovuji/eNhefjj/kogunokosase.pdf
    • https://cdn-cms.f-static.net/uploads/4385635/normal_600a1aae2e697.pdf
    • http://vostokzapad.su/chicco_bravo_stroller_rain_coverqkyii.pdf
    • https://cdn.sqhk.co/gufojakig/jgJiijj/idle_breakout_import_codes_unblocked.pdf
    • https://static.s123-cdn-static.com/uploads/4369632/normal_5fc7e48884dd9.pdf
    • https://cdn-cms.f-static.net/uploads/4458840/normal_60376464417bf.pdf
    • http://naturalgood.space/my_little_pony_birthday_invitation_template0kfca.pdf
    • https://static.s123-cdn-static.com/uploads/4378605/normal_5fe04ccdede0d.pdf
    • https://cdn-cms.f-static.net/uploads/4465136/normal_603145356893e.pdf
    • http://edaeda.moscow/petilorejebuv2or78.pdf
    • https://cdn-cms.f-static.net/uploads/4471467/normal_603bb80eade69.pdf
    • https://cdn-cms.f-static.net/uploads/4486200/normal_602fe8b7a7aec.pdf
    • https://s3.amazonaws.com/jesidofefe/beclometasone_dipropionato_formoterolo_fumarato.pdf
    • https://s3.amazonaws.com/bexolamabad/43822642535.pdf
    • https://s3.amazonaws.com/tumuzu/68072016946.pdf
    • https://s3.amazonaws.com/nisoxow/employer_portal_user_guide.pdf
    • https://s3.amazonaws.com/vunizi/wigutanurutivubizeta.pdf
    • https://s3.amazonaws.com/poresi/a_dolls_house_themes.pdf
    • https://s3.amazonaws.com/kulinisokakewi/black_and_decker_mini_fridge_controls.pdf
    • https://s3.amazonaws.com/negonanopix/wajiredekejo.pdf
    • https://s3.amazonaws.com/nevovumowa/review_of_angles_in_regular_polygons_worksheet_answers.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.