Malicious PDF — malware analysis report

Static analysis result for SHA-256 8055eab4fbe46182…

MALICIOUS

PDF

116.7 KB Created: 2020-02-07 09:35:09 +06:30 Authoring application: fCoder PDF producer First seen: 2020-07-24
MD5: c4919f52135e7aefa6c8587dc0c58f56 SHA-1: c63cf730ae478e4e02d68b26ae2018cdbe9a32f5 SHA-256: 8055eab4fbe461826ef23cc5e4980e6f821b51aff587ea1e8e0bd4b598f74293
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by an ML classifier and exhibits characteristics of a phishing lure, specifically an image-based one with a clickable action. The embedded URI points to an external website, suggesting a potential redirection for further malicious activity. No scripts were extracted, but the PDF structure itself indicates a deceptive intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6365

Heuristics 3

  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 116 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI low PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.print-driver.com/?demolabel-en PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.