Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a0e4ca538b462e0…

MALICIOUS

PDF

53.1 KB Created: 2021-03-24 05:04:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5722bb305a4a19fe09fa7529437cb9f3 SHA-1: 9d20e10488e30dbfb7c3af05a74dc448ef0e5c97 SHA-256: 6a0e4ca538b462e0cc1ccc51e213a9b4f207b820d761c8ada63d1f2beecb2f7c
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical for phishing attacks. It contains an embedded URI pointing to 'nipisod.ru', which is likely a malicious domain used to host a phishing page or distribute further malware. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8408

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 53 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=biology+science+for+life+with+physiology+5th+edition+pdf
    • https://cdn-cms.f-static.net/uploads/4487208/normal_600eaf265653b.pdf
    • https://kufidadifijerid.weebly.com/uploads/1/3/1/4/131407945/eed98.pdf
    • https://cdn-cms.f-static.net/uploads/4495402/normal_602fd37d1a7bd.pdf
    • https://cdn-cms.f-static.net/uploads/4500895/normal_5fd97e518d5e1.pdf
    • https://cdn-cms.f-static.net/uploads/4388407/normal_60594fa14c0d4.pdf
    • https://tureduritisamo.weebly.com/uploads/1/3/4/6/134676104/79f1e866.pdf
    • https://kabulemumolitu.weebly.com/uploads/1/3/4/8/134869515/3973345.pdf
    • https://lezanixopedem.weebly.com/uploads/1/3/4/8/134886347/cca6d457c42a.pdf
    • https://cdn-cms.f-static.net/uploads/4414339/normal_602ceac376c48.pdf
    • https://jemogofeti.weebly.com/uploads/1/3/4/0/134042608/7919085.pdf
    • http://pasendapp.online/8042956640310b4z.pdf
    • http://reduslim-ordina.site/58540893135921it.pdf
    • https://guzajemifuraruv.weebly.com/uploads/1/3/0/8/130874286/e9e931e8f1d1.pdf
    • https://cdn-cms.f-static.net/uploads/4460055/normal_603705e484e8c.pdf
    • https://zuvofuguwapu.weebly.com/uploads/1/3/4/0/134042474/mujojip_nebekevapopa.pdf
    • https://wizugelavuri.weebly.com/uploads/1/3/5/3/135325487/1149.pdf
    • https://static.s123-cdn-static.com/uploads/4453540/normal_5ff083493bdbc.pdf
    • https://s3.amazonaws.com/nazekisigiduz/what_does_capitalize_mean_in_tax.pdf
    • https://s3.amazonaws.com/wizidimawag/samsung_un40j6200afxza_price.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.