Malicious PDF — malware analysis report

Static analysis result for SHA-256 97a0ac3d811d0d81…

MALICIOUS

PDF

55.8 KB Created: 2021-03-20 05:40:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 709af24c9021e1ec7e4d4f85d269751e SHA-1: 8fec12bb97ea3b8ed54888efba17cc5b429104e5 SHA-256: 97a0ac3d811d0d813687be20b9f9e6fe2058d66e63f1d0e40ab13f3a19106322
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ClamAV and an ML classifier, and it exhibits characteristics of a phishing lure. The heuristic 'PDF_IMAGE_LURE' indicates that the document is image-only with an action trigger, designed to entice clicks on embedded links. The primary external URI points to a suspicious domain, suggesting it's the intended destination for the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9785

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 55 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=sample+business+introduction+letter+to+prospective+clients+pdf
    • https://cdn-cms.f-static.net/uploads/4385011/normal_60554dce8d44c.pdf
    • http://mukinumatonewo.getenjoyment.net/biology_class_12_book_download.pdf
    • https://cdn-cms.f-static.net/uploads/4476577/normal_6044d1977c905.pdf
    • https://cdn-cms.f-static.net/uploads/4401505/normal_60303e270a56b.pdf
    • https://static.s123-cdn-static.com/uploads/4414336/normal_5fee70a9ab252.pdf
    • https://cdn-cms.f-static.net/uploads/4459054/normal_601b999072497.pdf
    • http://gezinuduwep.medianewsonline.com/16295572775.pdf
    • http://nojigopagapusu.mygamesonline.org/suburik.pdf
    • http://kufowawixapiva.sportsontheweb.net/casio_w-800h_change_time.pdf
    • http://sikufitunowapon.22web.org/16949528277.pdf
    • http://pofaduxiruk.getenjoyment.net/where_can_i_get_thanksgiving_dinner_to_go.pdf
    • http://legegapepapo.medianewsonline.com/dish_remote_code_for_sony_dvd_player.pdf
    • https://s3.amazonaws.com/satedafadusizo/42938560948.pdf
    • http://jifisuxevizek.myartsonline.com/free_2nd_grade_book_report_template.pdf
    • http://webixulibuka.rf.gd/base64_string_to_php.pdf
    • https://s3.amazonaws.com/ruzumeb/66199658997.pdf
    • https://s3.amazonaws.com/gumegulaxi/icewind_dale_2_complete_download.pdf
    • http://wipadafefuxasi.onlinewebshop.net/biochemistry_and_molecular_biology_of_plants_free_download.pdf
    • http://sogoxutagejuno.atwebpages.com/20954211232.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.