Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae1f01206c3f4fb8…

MALICIOUS

PDF

57.6 KB Created: 2021-04-21 07:26:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f668aaedccd68b0c357e9f67d3b655bc SHA-1: 50c7af30d0fa02d1558992e1850aa0394992c4ba SHA-256: ae1f01206c3f4fb8f684e9b86a045eb3664ae6a05dbffaa5edfe474a86ce1c93
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF document that contains embedded URLs, one of which is presented as information about a dishwasher error code. ClamAV detected this file as Pdf.Phishing.Trojan, and an ML classifier also flagged it as malicious. The primary attack pattern involves luring the user to click on a URL, likely for phishing or to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6699

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ambrose.edu/sites/default/files/webform/99544266771.pdf
    • https://extranet.blanchisserie-toulousaine-de-sante.com/sites/extranet.blanchisserie-toulousaine-de-sante.com/files/documents/justificatifs/bugoxugokerudanetisene.pdf
    • https://ambrose.edu/sites/default/files/webform/28695523124.pdf
    • http://russian-ice-spb.ru/sites/default/files/webform/files/69309865186.pdf
    • https://www.uts.cw/sites/default/files/webform/47116150145.pdf
    • http://cicatsalud.com/html/sites/default/files/webform/15691680518.pdf
    • https://vectorcorp.net/sites/default/files/webform/resume/dufovomajaxavekasodulep.pdf
    • http://oaklandchildcare.org/sites/default/files/webform/71502920023.pdf
    • https://www.jsif.org/sites/default/files/webform/vinuriruxelapaviwona.pdf
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BvfzZFkJO3s/uplcv?utm_term=lg+direct+drive+dishwasher+error+code+cd
    • https://www.ice.cam.ac.uk/sites/www.ice.cam.ac.uk/files/webform/68876097481.pdf
    • https://community.princeton.edu/system/files/webform/xakefabobadu.pdf
    • https://gradfutures.princeton.edu/system/files/webform/42179508969.pdf
    • https://lib.asu.edu/system/files/webform/rutepirunumobapof.pdf
    • https://printandmail.princeton.edu/system/files/webform/68272747422.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.