Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbfe68d7aca2be78…

MALICIOUS

PDF

57.2 KB Created: 2021-03-28 04:33:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4f3008c81fbb13f0e4f909680d8c3675 SHA-1: 3c1198d84b862bc71a9897d4c538fabc93cf9354 SHA-256: bbfe68d7aca2be78960bb135fdcabd42890f6c0fe0ef911c30386a02d15bdf45
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as a phishing lure due to its small size and the presence of an image-only design with an action trigger. The embedded URL, 'https://xajibur.ru/award?keyword=workers+compensation+qld+pdf', is highly suspicious and likely leads to a malicious payload or phishing page. No scripts were extracted, but the overall structure and heuristic firings strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7030

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 57 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=workers+compensation+qld+pdf
    • http://xijivedijimidip.mygamesonline.org/automatic_car_parking_system_using_8051_microcontroller.pdf
    • http://katipef.medianewsonline.com/printable_balderdash_cards.pdf
    • https://cdn.sqhk.co/tosobulig/bjjihgj/cops_and_robbers_jail_break_download_free.pdf
    • https://cdn.sqhk.co/jutigurotow/Uhheqgg/car_parking_multiplayer_download_uptodown.pdf
    • http://powajaxib.medianewsonline.com/jeromadejuxemitit.pdf
    • https://cdn.sqhk.co/senosekagoko/hfigSgf/pogojabolifik.pdf
    • https://cdn.sqhk.co/tisorobew/Yv1ODih/supply_chain_management_textbook_pearson.pdf
    • http://zekifafeter.scienceontheweb.net/13293569634.pdf
    • https://cdn.sqhk.co/damukowabij/jUGifTe/23942638783.pdf
    • https://uploads.strikinglycdn.com/files/b2241394-fa99-4067-93d3-fdb36d9f419c/66332129823.pdf
    • http://kexeban.rf.gd/wubisajatovizores.pdf
    • http://lapakak.rf.gd/68089872620.pdf
    • https://uploads.strikinglycdn.com/files/e0989627-7a7e-4333-a966-8c8a8ffb2f7b/xufipogade.pdf
    • https://5bf49506-6ef1-42f8-8f90-7e3689255fd3.filesusr.com/ugd/8fe1bf_f73d74795c9846deabbe423e2a66b345.pdf?index=true
    • http://wunekoxewufomaf.epizy.com/zivab.pdf
    • https://ef733714-782c-48ea-8991-1bc0bf0c95f2.filesusr.com/ugd/ad2ade_c263f41529014be99b590ef2e9bcbe69.pdf?index=true
    • https://edefa294-c65c-46c5-840b-8a4669b9fdfe.filesusr.com/ugd/e4a001_f97ca7e0613d4f28a8b3a74376eed81a.pdf?index=true
    • https://6acf0ca1-aa41-4771-8b91-54baff69ee7f.filesusr.com/ugd/7d1dc9_9faf48a8d9c144538bbdd84707b8ac71.pdf?index=true
    • https://6e7ef639-f89a-4701-86f9-710a836f1183.filesusr.com/ugd/12745a_2d9d22505b2443389a4fd3486c2ad6e2.pdf?index=true
    • http://ruguwozud.epizy.com/muwozegagotanaku.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.