Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cc4e7e547f8fe7a…

MALICIOUS

PDF

54.5 KB Created: 2021-02-28 00:35:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: ee66e6a84f8feae61c1fcf3d5885b096 SHA-1: e8ad0e848aef22a8c541fa5c34f7973accfa53a9 SHA-256: 8cc4e7e547f8fe7ab0622395730e1a22bee2991bd5178442a43d5d90c1145eea
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8597

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=where+to+purchase+a+speed+queen+washer PDF link annotation
    • http://sugameloxufe.mywebcommunity.org/how_much_does_it_cost_to_become_an_emt_in_texas.pdfIn PDF document text
    • http://kavelizopepi.mywebcommunity.org/zovimipi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408881/normal_5ff16e8ed0365.pdfIn PDF document text
    • https://cdn.sqhk.co/zegareguw/iiijakK/tao_tao_4fun_200_go_kart_4_seater.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387230/normal_6034dc3408fec.pdfIn PDF document text
    • http://begemotiks.fun/best_app_for_vocabulary_builder_iphoneofz4r.pdfIn PDF document text
    • http://chambrehq.xyz/4000521402aue2k.pdfIn PDF document text
    • http://plusstore.pro/vetezenitirilepifr9fy.pdfIn PDF document text
    • https://s3.amazonaws.com/wuvepilamamuse/zofenejeretedalejobidu.pdfIn PDF document text
    • http://xuxerutiwuv.onlinewebshop.net/pomidemazogazu.pdfIn PDF document text
    • http://bebovufuvuji.myartsonline.com/how_do_you_set_the_time_on_a_la_crosse_radio_controlled_clock.pdfIn PDF document text
    • https://s3.amazonaws.com/metakibeme/jonenusofanebusumimaja.pdfIn PDF document text
    • https://s3.amazonaws.com/topipovikapari/telasirugapanajefe.pdfIn PDF document text
    • https://s3.amazonaws.com/jixerubowi/king_size_platform_bed_plans_free.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.