Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c65341f11890c60…

MALICIOUS

PDF

55.8 KB Created: 2021-03-12 10:41:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 9948fbecdb121b5c9246a9a024c8ece5 SHA-1: 3fd6b83893838abfc7081574c4405ba508de9658 SHA-256: 8c65341f11890c60d32097ffd1042d24dbed75216e9b64175c928cc4b5b5bf27
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, which is likely used to deliver a malicious payload or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to a tutorial, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7127

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=tutorial+autocad+2020+3d+pdf+bahasa+indonesia PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4481162/normal_6021bb969b41f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4494661/normal_6018cc21d07a5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469831/normal_6022c1973c72b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373797/normal_603e5846e4f63.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369657/normal_60086b03bbec5.pdfIn PDF document text
    • https://s3.amazonaws.com/lotibabakuj/sanegexojofifemonogeg.pdfIn PDF document text
    • https://s3.amazonaws.com/xijuxosisomuna/stock_market_back_office_software_free.pdfIn PDF document text
    • https://s3.amazonaws.com/resisuna/jam_jar_labels_templates.pdfIn PDF document text
    • https://s3.amazonaws.com/fizaxo/4516893823.pdfIn PDF document text
    • https://s3.amazonaws.com/wupagivoz/automatic_call_recorder_pro_apk_latest_version.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a2f6c41-cbaa-4d92-a976-13215b38e163/zalidelo.pdfIn PDF document text
    • https://s3.amazonaws.com/pegozegi/physical_science_textbook_9th_grade_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/86139b80-bde1-4ea3-91a8-f6effff7fba3/how_long_will_a_buddy_heater_run_on_a_20_lb_tank.pdfIn PDF document text
    • https://s3.amazonaws.com/kibavutibeved/shooting_stars_meme_video.pdfIn PDF document text
    • https://s3.amazonaws.com/naxozelozude/12066485549.pdfIn PDF document text
    • https://s3.amazonaws.com/wewuxuviwar/upsc_cds_ii_online_form_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/tomaxade/43095641263.pdfIn PDF document text
    • https://s3.amazonaws.com/kewuxejikiwe/lobezigema.pdfIn PDF document text
    • https://s3.amazonaws.com/tugabijenovili/adafruit_neopixel_arduino.pdfIn PDF document text
    • https://s3.amazonaws.com/jiwisigetizoxif/instagram_layout_template_photoshop.pdfIn PDF document text
    • https://s3.amazonaws.com/vuliwisuwig/43619204311.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b2d9d26f-ec70-47f9-a93a-4217f07c4f62/utopia_for_realists_nyt_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/289da5c9-bd5f-47a0-a9b0-cd5eb870144c/rejojeroniba.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.