Malicious PDF — malware analysis report

Static analysis result for SHA-256 7526bffb6e015d53…

MALICIOUS

PDF

59.2 KB Created: 2021-03-03 18:40:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fbd9c5feff818a46405cc860bc36c7e9 SHA-1: 0ad7e62de8dfefa12d918ea9faf72539b2b25ab3 SHA-256: 7526bffb6e015d530c58c683385151701c7fa2ba72e6ed0ce70b74ee64b486db
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a URL that appears to be a search result for a specific product reset procedure, likely a lure to encourage clicks. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the detection suggest a phishing or trojan distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6200

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wb?keyword=swann%20dvr8-4575%20hard%20reset
    • http://antinomi.design/worksheet_on_synonyms_antonyms_and_homonymsznq4e.pdf
    • https://wimavebitajiki.weebly.com/uploads/1/3/4/6/134609796/wetinon.pdf
    • http://myluckywin.site/stocks_to_buy_under_5_rsucc3p.pdf
    • https://cdn.sqhk.co/linidivez/fp1ijgd/vizogonuturuwelavub.pdf
    • https://vivexizakodol.weebly.com/uploads/1/3/1/4/131483194/9394e.pdf
    • https://cdn.sqhk.co/wanevakaxuma/jdhbDAP/ultimate_wolf_simulator_2_pc.pdf
    • http://gladkoe-telo.xyz/interstellar_hindi_dubbed_download_ftr2jv.pdf
    • https://palarijebatexo.weebly.com/uploads/1/3/4/3/134338538/9587907.pdf
    • https://bubigijezifaju.weebly.com/uploads/1/3/1/3/131380429/8864001.pdf
    • https://cdn.sqhk.co/saseponirifa/BahiihX/free_message_tones_for_android_phones.pdf
    • https://s3.amazonaws.com/wemupajese/league_of_legends_twitch_adc_guide.pdf
    • http://kopolug.myartsonline.com/what_is_gender_and_development_approach.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.