Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cad8d9db3182eef…

MALICIOUS

PDF

48.4 KB Created: 2021-09-07 03:14:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: abb6fa422c4a4aa8496b44f3da97017d SHA-1: 08d63f6c2344f86c121cc0c2aabc47c3e9032fc0 SHA-256: 8cad8d9db3182eef5f90384659a6b8c1c6e980b6ac7658701de51b8d1b02e38e
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a 'Pdf.Phishing.Trojan' signature. It contains an embedded URI that, while flagged as benign, points to a URL that appears to be a lure for downloading a PDF. Several other unknown reputation URLs are also present, suggesting a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4722

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://raegcafe.com/uploads/files/58877129932.pdf In PDF document text
    • https://sportli.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/1606f3d6904f4e---fozutamusaduxewa.pdfIn PDF document text
    • https://siyata.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/16081280eaf4ae---68768088342.pdfIn PDF document text
    • http://moonlightmontessori.com/upload/files/2796181612.pdfIn PDF document text
    • http://shijijiaming.cn/filespath/files/20210819061202.pdfIn PDF document text
    • http://sakulchaiplace.com/Uploads/file/kepazuxijunejedovikuno.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/S30rS-6n6vg/uplcv?utm_term=profit+vs+wealth+maximisation+pdfPDF link annotation
    • https://tes-sys.com/uploads/ckfinder/files/20210725/16272173789536.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.