Malicious PDF — malware analysis report

Static analysis result for SHA-256 74366f5904adc057…

MALICIOUS

PDF

54.3 KB Created: 2021-05-04 20:46:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5528f8a927203e1d814d01ffbe5ff7a3 SHA-1: cd639145f35a3b1d280d329b1f1334bda9955da1 SHA-256: 74366f5904adc05790a02c01745f74af18199e520f24c5bde62f52dd16ef45f1
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains heuristics indicating it is malicious and has been flagged by a classifier. It also contains embedded URLs, one of which is a known benign link, but others point to potentially malicious PDF files. The document body, though heavily obfuscated, appears to be a lure for a game download, suggesting a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7284

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://arenda1s.ru/wp-content/plugins/super-forms/uploads/php/files/c4d4a0cb296dbd0f49f51cbc2e590748/334864370.pdf
    • http://jnnycc.org/userfiles/file/lezuwiviwakireremudozuje.pdf
    • http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083f66c742bc---jumobogokirutoloju.pdf
    • https://brylka-kfz.de/wp-content/plugins/formcraft/file-upload/server/content/files/160798bf728607---87681341754.pdf
    • http://contentworks.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1606f684999d8b---31275720536.pdf
    • https://alcc.vn/wp-content/plugins/super-forms/uploads/php/files/7fihfso64hipdeo7lusqq0f96j/fikojego.pdf
    • http://www.medical-psychology.gr/wp-content/plugins/formcraft/file-upload/server/content/files/1606c8b83a547a---fobemimof.pdf
    • https://thetitangroup.ca/wp-content/plugins/super-forms/uploads/php/files/93beb506c668baf433e3a482278f165c/wexopobeberovisapajik.pdf
    • https://nam.it/wp-content/plugins/formcraft/file-upload/server/content/files/160789c2aa08f7---wixezimut.pdf
    • https://backcountryplayground.com/wp-content/plugins/super-forms/uploads/php/files/887882eac3b974f6669abd8e1adc7eea/mutopoxupuxuwizezopakogu.pdf
    • https://trellisdundee.com/wp-content/plugins/super-forms/uploads/php/files/5cc3a7dabc5af15b1264b91e57de3960/jigidupubekogipaxiwoxinu.pdf
    • https://caravanandre.it/wp-content/plugins/super-forms/uploads/php/files/3d02fb505c2c1b9ebf5cad79173cd7aa/20723183571.pdf
    • http://for-rent-antwerp.com/wp-content/plugins/formcraft/file-upload/server/content/files/160752d371b25f---jobamoxisonatuv.pdf
    • http://matstravel.ru/userfiles/file/86254175369.pdf
    • http://renovator.cz/files/file/lijetugenutet.pdf
    • https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/6708u4d2ve47tf9mikol7nbn8r/tipafut.pdf
    • https://ventana-sur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c97fca1aa0.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/LPIa9PGmDLg/uplcv?utm_term=minecraft+full+game++windows+10+free

Open this report in the interactive analyzer, or submit your own file for analysis.