Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7ffae6c3b04ee06…

MALICIOUS

PDF

58.6 KB Created: 2021-02-26 23:15:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: b088d0243cd07fba74b4ba123a9edaad SHA-1: bc94494d70b703822c7e0d2d85b95c8ea7334d0e SHA-256: b7ffae6c3b04ee06094ae269dc83b0bdf6b97ae02a97b0681b38e54339c9cbe2
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded URI pointing to a suspicious domain, which is a strong indicator of phishing or malware distribution. The ML classifier and ClamAV detection further confirm its malicious nature. Although no scripts were explicitly extracted, the presence of external URIs suggests the document is designed to redirect the user to a malicious site, likely for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6847

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=accessory+unit+income PDF link annotation
    • https://cdn.sqhk.co/xogovofofi/jcrgjSh/zapuxuvenuxanudesuziri.pdfIn PDF document text
    • https://nefatalij.weebly.com/uploads/1/3/2/7/132740339/vaxuxejemuxod.pdfIn PDF document text
    • https://vorufiduwesonuf.weebly.com/uploads/1/3/5/3/135314955/wiwote.pdfIn PDF document text
    • https://cdn.sqhk.co/vunebapenuj/gd2yVjf/rixanowopis.pdfIn PDF document text
    • https://cdn.sqhk.co/veletafi/gjhtCXf/51630341996.pdfIn PDF document text
    • http://ronifibofizet.medianewsonline.com/zidonos.pdfIn PDF document text
    • https://cdn.sqhk.co/dikizumi/BheCoZ4/6380005636.pdfIn PDF document text
    • https://cdn.sqhk.co/takodabu/4idhdia/jadumumelotigovijepuk.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366381/normal_5fcfa08a52a43.pdfIn PDF document text
    • https://cdn.sqhk.co/zogobadakedu/djegdjd/modern_warfare_warzone_update_requires_restart.pdfIn PDF document text
    • http://jepenufi.getenjoyment.net/choke_chuck_palahniuk_review.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393181/normal_5ffb83d12710e.pdfIn PDF document text
    • https://s3.amazonaws.com/wixanarer/can_t_netflix_shows_too_many_devices.pdfIn PDF document text
    • https://s3.amazonaws.com/sukobogixe/fusafimagitir.pdfIn PDF document text
    • https://s3.amazonaws.com/zemigiduwagafu/57631325532.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.