Malicious PDF — malware analysis report

Static analysis result for SHA-256 95bfe6ceb7ecd788…

MALICIOUS

PDF

52.6 KB Created: 2021-02-24 16:32:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 551da6f45d776dc32fd3609677702a56 SHA-1: 7570009ba86f0de068e05788620fb765cfe42f70 SHA-256: 95bfe6ceb7ecd78821ae6ac38ad59598b1b54719e13690973e594f516d3b9d0d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a heuristic firing for an external URI pointing to a suspicious domain, and multiple other embedded URLs that are likely part of a phishing or malware distribution scheme. The ML classifier and ClamAV detection further support its malicious nature. The document body, though heavily obfuscated, appears to be a lure related to a search query.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7590

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/award?keyword=how+to+turn+off+bontrager+trip+100 PDF link annotation
    • https://cdn.sqhk.co/tamaladafa/zYihhdX/30607232386.pdfIn PDF document text
    • http://7gusevshop.website/21737662164p75iz.pdfIn PDF document text
    • http://sugameloxufe.mywebcommunity.org/does_the_lexus_hybrid_require_premium_gas.pdfIn PDF document text
    • http://ctyr.ru/wheel_of_fortune_game_for_android9jhkj.pdfIn PDF document text
    • http://hookup154.fun/zesotenozezobezozesikabuayg2.pdfIn PDF document text
    • http://jedomagisuw.getenjoyment.net/rosudajiboxatokuwiritex.pdfIn PDF document text
    • http://strongcreditscore.info/words_to_stressed_out_by_twenty_one_pilotsdbyuz.pdfIn PDF document text
    • http://nasufulorejuwe.mywebcommunity.org/fl_studio_tutorial_hip_hop.pdfIn PDF document text
    • https://s3.amazonaws.com/vavale/balance_sheet_format_of_manufacturing_company.pdfIn PDF document text
    • http://wugujub.onlinewebshop.net/how_to_install_sena_20s_evo.pdfIn PDF document text
    • https://s3.amazonaws.com/womirofop/avast_internet_security_2018.pdfIn PDF document text
    • http://widifusi.myartsonline.com/83727854422.pdfIn PDF document text
    • https://s3.amazonaws.com/muvarelo/43639101614.pdfIn PDF document text
    • https://s3.amazonaws.com/gebukil/jikemizojawezuniponajat.pdfIn PDF document text
    • https://s3.amazonaws.com/winumigutam/wonopetatudovirexeruk.pdfIn PDF document text
    • https://s3.amazonaws.com/falufusu/a_thousand_years_pagalworld.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.