Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a1c655ecec0659f…

MALICIOUS

PDF

51.9 KB Created: 2021-05-13 09:43:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0977a136779216b4dfbb5142b8c87664 SHA-1: 6b17dac373fd89b8bbb1d0101c6b8ac6544db85d SHA-256: 9a1c655ecec0659f8e0274f9942fd2e443b84ed68655c8c80336f25147bbe919
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a heuristically identified random URL link, which is a strong indicator of malicious intent. The ML classifier also flagged this PDF as malicious. The presence of embedded URLs suggests an attempt to redirect the user to a potentially harmful site, likely for phishing or to download further malware. No scripts were extracted, but the PDF structure itself is suspicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8318

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://deurwater.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d1639ca6b0---17301174368.pdf
    • https://baoholaodong24.com/userfiles/file/38937265368.pdf
    • https://wholisticvibrations.com/wp-content/plugins/super-forms/uploads/php/files/ee52821b1158f6cea3807ce251fa5ee2/netokepufotamevukav.pdf
    • https://brylka-kfz.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608be6e1b0504---53868206488.pdf
    • http://oneself.pro/wp-content/plugins/formcraft/file-upload/server/content/files/160827c34e09fc---goxopex.pdf
    • http://inewbus.com/wp-content/plugins/super-forms/uploads/php/files/qrj0d8ri75mamlianick984pj6/92573650139.pdf
    • http://cageart.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607c8d0e8f55c---98419412720.pdf
    • http://a-range.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16070d8e661015---jamozamal.pdf
    • https://sumangold.net.vn/wp-content/plugins/super-forms/uploads/php/files/n1qinqnqe9tmbcg3ll2b202svh/kavumoxexiwoneriwujed.pdf
    • https://chocoinmobiliario.com/wp-content/plugins/super-forms/uploads/php/files/9c85c738ccabdc15c48c2f823833b73b/71833831745.pdf
    • http://www.sunarnuricomuisvealisverismerkezi.com/wp-content/plugins/super-forms/uploads/php/files/4ig8fevelg05h3kd3j5t1mknh0/56621743326.pdf
    • https://genesisbehaviorcenter.com/wp-content/plugins/super-forms/uploads/php/files/5ba6b2d78340739e1e9e0366119d0805/rogavupokinodago.pdf
    • https://fobiy.net/wp-content/plugins/super-forms/uploads/php/files/28f17320c79008558a756d84910f957b/79879370634.pdf
    • http://www.yourhealthyourchoice.org/wp-content/plugins/formcraft/file-upload/server/content/files/1609250a3ef7dd---zuwunuw.pdf
    • https://velvetskin.pl/wp-content/plugins/super-forms/uploads/php/files/00fc9f5b47b9b7186f65f438c89aa325/28177592131.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/A3Ryygt5BCM/uplcv?utm_term=easd+guidelines+2018

Open this report in the interactive analyzer, or submit your own file for analysis.