Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b9b471164c68d4d…

MALICIOUS

PDF

43.5 KB Created: 2021-04-02 09:41:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 942d2da9890682f4a6e9854c29007744 SHA-1: 87802f0305f57adba7881bb0231e83c102df0456 SHA-256: 7b9b471164c68d4d0da52e8e89ee4ff63d3c5bf883fabe2f4878078fa5196009
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as malicious by ClamAV and an ML classifier, and exhibits characteristics of a phishing lure. The 'PDF_IMAGE_LURE' heuristic indicates it's an image-only document with a clickable action, designed to trick users into visiting a malicious URL. The embedded URL 'https://xajibur.ru/award?keyword=auditing+pdf+notes' is a strong indicator of this intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7134

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 43 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=auditing+pdf+notes
    • http://taxevidel.medianewsonline.com/gugerusemukizof.pdf
    • http://xogavuw.medianewsonline.com/jokenasonax.pdf
    • https://cdn.sqhk.co/wopidaxiwuk/Duidifj/learn_master_guitar_book.pdf
    • http://xupenoxerukaj.22web.org/weight_watcher_scale_shows_err.pdf
    • https://cdn.sqhk.co/danexili/j4ha8ig/miroir_projector_m20.pdf
    • http://sagedix.medianewsonline.com/the_secret_doctrine_blavatsky.pdf
    • http://xukavegogeb.22web.org/95020641910.pdf
    • https://cdn.sqhk.co/manaruparil/ifjjgic/ziraleluwagipige.pdf
    • http://lexanizisujufum.66ghz.com/boseruterafugej.pdf
    • http://gofadivus.mygamesonline.org/31621208380.pdf
    • http://giwofigu.epizy.com/appreciative_inquiry.pdf
    • https://uploads.strikinglycdn.com/files/2fc63116-eef2-462e-b09c-6e05f1485111/buniwasekufitub.pdf
    • http://banobozibijur.epizy.com/fashion_brand_business_plan_template.pdf
    • https://s3.amazonaws.com/janodojivi/wozobosifugude.pdf
    • https://uploads.strikinglycdn.com/files/af969b3e-6a67-489f-b108-d9d707152762/constitucion_mexicana_articulos_del_medio_ambiente.pdf
    • https://s3.amazonaws.com/kukazowox/wheel_of_fortune_cheat_sheet_person.pdf
    • https://s3.amazonaws.com/patilawasu/kexidupixagujafanedazasub.pdf
    • https://s3.amazonaws.com/lepefi/jumerivisasukoxivezi.pdf
    • https://s3.amazonaws.com/fotepopunaj/12665196093.pdf
    • https://uploads.strikinglycdn.com/files/c835c6d1-015e-48ae-92cd-10e05ce7f7fa/xidosuwore.pdf
    • https://s3.amazonaws.com/jolituzoji/steam_game_keeps_restarting.pdf
    • https://s3.amazonaws.com/lolaritemukole/duwibilubi.pdf
    • https://s3.amazonaws.com/benubapopikaj/91329580909.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.