Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b120fbed0b84769…

MALICIOUS

PDF

64.0 KB Created: 2020-10-27 14:58:50 +03:00 Authoring application: Julia Patterson (via Jacqueline Thomas)
MD5: 88b384158c099afe3e21cec403e44029 SHA-1: 54def6c73c928f63a3a66c60189789d83b47aea0 SHA-256: 6b120fbed0b84769f4fd9c66b25f5a716fd093182f6da149b024167c91b100c4
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical of phishing attacks, with heuristics indicating it contains clickable actions leading to external URIs. The document body, though heavily obfuscated, contains metadata suggesting it was authored by 'Julia Patterson' and intended for 'Jacqueline Thomas', potentially part of a social engineering pretext. The presence of external URLs and a local builder path further supports the malicious intent of directing users to attacker-controlled infrastructure.

Machine Learning

  • Nyx PDF Classifier clean score 0.1762

Heuristics 4

  • Image-only PDF carries local builder path plus remote links high PDF_IMAGE_LURE_LOCAL_FILE_AND_REMOTE_URI
    PDF is an image-only click lure that contains both remote HTTP(S) destinations and a file:/// URI exposing a local Windows/Linux builder path. That co-occurrence is not normal document linking; it matches generated clickbait/phishing carriers where the visible page is a screenshot and the clickable area sends the user to external infrastructure.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 63 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eup6hae.wwm
    • http://zdipzy0.sed.macabrepoe.com

Open this report in the interactive analyzer, or submit your own file for analysis.