Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae4fe7d393c6aed4…

MALICIOUS

PDF

195.8 KB Created: 2021-06-09 23:25:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 77296692120dcdd66a47fae6e38b318d SHA-1: f3593062e875846a0d61116363fae7da3dc1a95d SHA-256: ae4fe7d393c6aed416285e96b54c6c8c78f7aeff95de4536ee7efb734de9670d
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a 'Pdf.Phishing.Trojan' signature. It contains an embedded URL pointing to a domain that appears to be a phishing lure for song downloads. While no scripts were explicitly extracted, the PDF structure and the presence of a malicious URL suggest an attempt to redirect the user to a compromised site for further malicious activity.

Machine Learning

  • Nyx PDF Classifier clean score 0.1493

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/uplcv?utm_term=ek+mulaqat+mein+baat+hi+baat+mein+song+download+pagalworld PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.