PDF malware analysis — malicious · 7ce226bfb2d06818

MALICIOUS

PDF

58.2 KB Created: 2021-04-29 03:23:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c7c97a1b37d94786c9002e5fa512f501 SHA-1: a1d1b16fcf9ddcf3ad5df5d49c387c6f79001564 SHA-256: 7ce226bfb2d068188b17a1a44a20809a009790ffc50ab5c0c0cae6a80ab7341a

114 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ClamAV and an ML classifier. It employs a common phishing tactic by presenting a screenshot of content, likely to entice the user to click on an embedded link. The heuristic 'PDF_IMAGE_LURE' confirms this, indicating the document is image-heavy with an action trigger. The primary IOC is the external URI found, which likely leads to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.6606

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 58 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://maypoin.ru/strik?utm_term=la+casa+de+bernarda+alba+resumen
- https://cdn-cms.f-static.net/uploads/4408009/normal_601ace5c7f6a0.pdf
- https://static.s123-cdn-static.com/uploads/4448330/normal_5fec09c718170.pdf
- https://cdn-cms.f-static.net/uploads/4476954/normal_5fe9ba86c2b03.pdf
- https://cdn-cms.f-static.net/uploads/4374848/normal_603443476fa28.pdf
- https://cdn-cms.f-static.net/uploads/4380681/normal_600b6a3ef2ebc.pdf
- https://static.s123-cdn-static.com/uploads/4474746/normal_5fcd57bfd278e.pdf
- https://cdn-cms.f-static.net/uploads/4385636/normal_603072c211e81.pdf
- https://static.s123-cdn-static.com/uploads/4375908/normal_5fe4d34638a2a.pdf
- https://cdn-cms.f-static.net/uploads/4369487/normal_60210885d7639.pdf
- https://static.s123-cdn-static.com/uploads/4389361/normal_5fe3e1c83ab3a.pdf
- https://static.s123-cdn-static.com/uploads/4380680/normal_5fdcd99823992.pdf
- https://cdn-cms.f-static.net/uploads/4457279/normal_6014653c58f85.pdf
- https://s3.amazonaws.com/jadere/cisco_ccna_voice_lab_manual.pdf
- https://e691ad07-92dc-45fa-af10-8929b4045ede.filesusr.com/ugd/87b9a8_06fbb9a87d2840f6a42217e63f81c381.pdf?index=true
- https://2080fafa-2491-4ac3-8118-a138f33bff34.filesusr.com/ugd/822ecd_7a656cb11d7e4c769ed2be259c5d1a55.pdf?index=true
- https://7d6e376e-1ee3-4df5-88c1-8d1511d419f8.filesusr.com/ugd/7dd30d_4e28a2f7aae84841a0aef7221732f917.pdf?index=true
- https://77bc4ea4-de20-41c0-a463-a5315db628d9.filesusr.com/ugd/2c69e3_edf1d3d1edd54412bbf10331a21ee0d4.pdf?index=true
- https://17851959-1482-4b49-8222-7b7b0c628459.filesusr.com/ugd/3cb679_27ffeda3fa6346468084049366b671f3.pdf?index=true
- https://777dd155-384c-4f1d-a337-8f27b94bb056.filesusr.com/ugd/1ecdae_e5423adb320a4acea8f3db82b3dd556e.pdf?index=true
- https://s3.amazonaws.com/kewuxejikiwe/wowonadebagalasavak.pdf
- https://d7179dab-c972-4501-9f4a-16044ca71e84.filesusr.com/ugd/434f74_b03bf2fdd52646c0a67b087a85163abf.pdf?index=true
- https://s3.amazonaws.com/jevelel/scripture_that_says_the_kingdom_of_god_is_within_us.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.