Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb92765175511196…

MALICIOUS

PDF

41.6 KB Created: 2020-12-27 20:23:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b5d29ea9d95dbbe71d61bee867b1f58e SHA-1: c51ba3d71ac677c93c22047ba5486b6585610af1 SHA-256: cb9276517551119688c0dd7d8bbbcaf9ab4d648d3c69bd47133e2c1b449fa01f
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as malicious by ML classifiers and ClamAV, and exhibits characteristics of a phishing lure. It contains an embedded URL that likely leads to a malicious site. The document body is heavily obfuscated and appears to be a screenshot, typical of lures designed to trick users into interacting with a hidden link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9297

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 41 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?utm_term=newry+reporter+facebook
    • https://cdn-cms.f-static.net/uploads/4474997/normal_5fb37708ded9a.pdf
    • https://cdn-cms.f-static.net/uploads/4373243/normal_5fc223f7979b7.pdf
    • https://lefiletigej.weebly.com/uploads/1/3/4/5/134597596/taxewafis.pdf
    • https://cdn-cms.f-static.net/uploads/4418970/normal_5fb72efa5608a.pdf
    • https://cdn.sqhk.co/zatufora/ii5iigj/699348044.pdf
    • https://cdn.sqhk.co/jawubibegeba/djcHjjh/popijasosax.pdf
    • https://cdn-cms.f-static.net/uploads/4412570/normal_5fa30b32c0d2d.pdf
    • https://cdn-cms.f-static.net/uploads/4454811/normal_5fbbff17d4449.pdf
    • https://cdn.sqhk.co/wozepefiga/Y58xibL/95174102839.pdf
    • https://uploads.strikinglycdn.com/files/e4f7fa58-b0b7-495d-bc5a-15716997afe7/67049086116.pdf
    • https://uploads.strikinglycdn.com/files/c8938a24-33a6-4b3b-ad23-8447206c76df/70883767306.pdf
    • https://uploads.strikinglycdn.com/files/ae8486f7-d439-4c75-a244-ffd9eb3579ec/25779685484.pdf
    • https://uploads.strikinglycdn.com/files/f23d58c6-32f6-4ff1-9e94-bd9906cd7354/16043376774.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.