Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d1bf23a216a3f6e…

MALICIOUS

PDF

58.6 KB Created: 2020-11-11 20:56:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 25b963b2359bcb18617d3fd8a907b227 SHA-1: e3ae692651e154222bd492f3c72e98f2e26372be SHA-256: 8d1bf23a216a3f6ed2303529fc781bfbe172c291b2baf58bb17a2c4b5e07e0af
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF containing an embedded URI that points to a suspicious domain, identified by heuristics and ClamAV as malicious. The document body is heavily obfuscated, but the presence of the external URI suggests an attempt to redirect the user to a malicious site, likely for phishing or malware delivery. No scripts were extracted, but the PDF structure itself facilitated the embedding of the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7213

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=howrah+bridge+audio+songs PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4426823/normal_5f9bcae81e445.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408703/normal_5fa73a0346256.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445882/normal_5fa1eea9a425e.pdfIn PDF document text
    • https://s3.amazonaws.com/duzexefemosaxe/raid_shadow_legends_mod_apk_latest_version.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ff57c53-4104-4540-a640-5ecb28c270d1/boricua_en_la_luna_poema_letra.pdfIn PDF document text
    • https://s3.amazonaws.com/paxivogedewilu/motherlode_mine_guide_osrs.pdfIn PDF document text
    • https://s3.amazonaws.com/zizene/airline_ticket_sample.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a74dc70d-d882-4e16-a2ee-6b0f9e34bbc4/41056285340.pdfIn PDF document text
    • https://s3.amazonaws.com/gajejasa/vojeso.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2121eb07-2d0f-4e88-b320-0d5539eec86d/24301447069.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5fc1b95-e9b1-46a3-a5fa-b5432098563f/7288549094.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd156836-a8c4-4e35-8ae2-5b8447cfabc6/junebetotunanedi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1029a8c-0db5-4f13-9368-44b3d660d883/7621946037.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb040a6b-3a21-40d2-929f-267bdfa0585f/xujebufupuba.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4c3bc96-7ebc-4c25-8137-2b4ccdc3b5bf/wadonede.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bfc3a45d-5ed9-4c2f-8347-2fd0d35fb4c4/24418117360.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.