Qakbot — PDF malware analysis

Static analysis result for SHA-256 99a43d6a161ed3a5…

MALICIOUS

PDF

44.0 KB
MD5: a32f669675c10f4837fb630d5315beeb SHA-1: f86a2b30705a527f0a484fadb35121193364e898 SHA-256: 99a43d6a161ed3a530567016094f20c413a27ea28fdb6aed2249ec4e0ec78c18
62 Risk Score

Malware Insights

Qakbot · confidence 95%

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The ClamAV heuristic 'Pdf.Downloader.Qakbot-9991263-0' strongly suggests Qakbot family involvement. The PDF contains an external URI pointing to a OneDrive download link, which is a common delivery mechanism for this malware. This indicates the PDF's primary purpose is to facilitate the download and execution of a secondary malicious payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.0150

Heuristics 3

  • ClamAV: Pdf.Downloader.Qakbot-9991263-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Downloader.Qakbot-9991263-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/iX/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://purl.org/dc/elements/1.1/

Open this report in the interactive analyzer, or submit your own file for analysis.