Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ec1cff9da0c6c50…

MALICIOUS

PDF

67.6 KB Created: 2021-04-05 14:32:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 6831f1bb84590db1045b9a46561b5b70 SHA-1: d8ffbe6966d931335241b73b7f71d3ad2ea3c437 SHA-256: 8ec1cff9da0c6c50349f35f04459c7bb2a5baf25647b454e2d781f59198890e5
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by multiple heuristics, including a ClamAV detection for Pdf.Phishing.Trojan and an ML classifier. The document body contains text related to printer pricing, which is likely a lure to direct the user to the embedded URL. This URL, https://botokaw.ru/aws?utm_term=how+much+is+hp+deskjet+2620+printer, is suspicious and likely serves as a phishing or malware distribution point.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6546

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/aws?utm_term=how+much+is+hp+deskjet+2620+printer PDF link annotation
    • https://cdn.sqhk.co/fokivetezabu/DWJicKG/flying_birds_gif_download.pdfIn PDF document text
    • http://babysampler.com/maps_master_for_minecraft_pe_apkhyrqw.pdfIn PDF document text
    • https://cdn.sqhk.co/wexufenu/j3hbhiy/imaginext_super_hero_flight_city_not_working.pdfIn PDF document text
    • https://cdn.sqhk.co/fevazufalul/Qiasib5/58952985885.pdfIn PDF document text
    • https://cdn.sqhk.co/vefusujix/jijbiET/54107553614.pdfIn PDF document text
    • http://autobuff.xyz/parler_social_media_stock_symbolvc414.pdfIn PDF document text
    • http://nuvagefo.medianewsonline.com/what_is_cvo_curriculum_vitae_in_tabular_form.pdfIn PDF document text
    • https://cdn.sqhk.co/risenulowo/cjbmjjg/alan_walker_magic_tiles_3.pdfIn PDF document text
    • https://cdn.sqhk.co/ramazunor/VlqOTii/whatsapp_for_nokia_e72-_1.pdfIn PDF document text
    • https://cdn.sqhk.co/kitujesijak/giijha1/phone_ringtones_youtube.pdfIn PDF document text
    • https://cdn.sqhk.co/vawadawuleja/heafhhP/dream_daddy_hugo_x_damien.pdfIn PDF document text
    • https://s3.amazonaws.com/risisipajole/99801049825.pdfIn PDF document text
    • https://s3.amazonaws.com/sazomo/calculus_3_solution.pdfIn PDF document text
    • https://s3.amazonaws.com/mipeboro/merikokag.pdfIn PDF document text
    • https://s3.amazonaws.com/sizabo/47286483316.pdfIn PDF document text
    • https://s3.amazonaws.com/kudowo/game_android_mod_highly_compressed.pdfIn PDF document text
    • http://woxesizefibugel.atwebpages.com/bankers_adda_current_affairs_june_2020.pdfIn PDF document text
    • https://s3.amazonaws.com/xulikamul/crazy_train_tuba_sheet_music.pdfIn PDF document text
    • https://s3.amazonaws.com/xuzed/lost_girl_episodes_watch_online_free.pdfIn PDF document text
    • https://s3.amazonaws.com/najubu/60166583252.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.