Malicious PDF — malware analysis report

Static analysis result for SHA-256 d660315793aa87e6…

MALICIOUS

PDF

64.0 KB Created: 2021-03-24 04:36:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: cfc7c681bef3d2397ae32a011e2f5d06 SHA-1: a03f677fa89570aaffec8302116d041bf48470a6 SHA-256: d660315793aa87e6ab526d75b789b83477e0b1e7ce6e8f47b0fe79d1f08394d0
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5221

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=paite+customary+law+pdf PDF link annotation
    • https://cdn.sqhk.co/fegukajebaj/IFYjeC7/destiny_2_companion_app_classified.pdfIn PDF document text
    • http://sejujanovemo.medianewsonline.com/salesforce_interview_questions_and_answers_for_experienced.pdfIn PDF document text
    • https://cdn.sqhk.co/vorinugobol/ijJFhdk/fast_driftssted_i_danmark_registrering.pdfIn PDF document text
    • https://cdn.sqhk.co/fevazufalul/dggjiGN/poweramp_music_player_full_apk_free_download.pdfIn PDF document text
    • https://cdn.sqhk.co/vikoparif/fXSgdih/metronome_beats_app_free_download.pdfIn PDF document text
    • https://cdn.sqhk.co/dozumapufa/bO8f6id/sonawegalevudasuligoloji.pdfIn PDF document text
    • https://cdn.sqhk.co/dizukenepu/gdiimgg/50204671287.pdfIn PDF document text
    • https://cdn.sqhk.co/disumuneriva/hdgfv2o/92239398905.pdfIn PDF document text
    • https://cdn.sqhk.co/zolulesar/r8gdIbp/space_agency_game_cheats.pdfIn PDF document text
    • https://cdn.sqhk.co/piwuzuberaze/6jiFIii/maze_ransomware_ioc_ip.pdfIn PDF document text
    • https://cdn.sqhk.co/zerurukoraju/CPjhelU/393190751.pdfIn PDF document text
    • http://tetizeniwa.mypressonline.com/32051332243.pdfIn PDF document text
    • http://nubuxeki.scienceontheweb.net/sales_and_marketing_director_job_description.pdfIn PDF document text
    • https://s3.amazonaws.com/dufekifaral/gejibutoxivo.pdfIn PDF document text
    • https://s3.amazonaws.com/novipaliwid/61825124366.pdfIn PDF document text
    • https://s3.amazonaws.com/wofaxil/befununapikibal.pdfIn PDF document text
    • http://zininorenedalo.onlinewebshop.net/wuxitovojabudubo.pdfIn PDF document text
    • https://s3.amazonaws.com/kakekojezutok/saga_of_tanya_the_evil_vol_2.pdfIn PDF document text
    • https://s3.amazonaws.com/mibiwivanetuj/jubilufanoke.pdfIn PDF document text
    • https://s3.amazonaws.com/sedowedi/h._e._r_album_2017.pdfIn PDF document text
    • https://s3.amazonaws.com/fusidejebi/zuzukaje.pdfIn PDF document text
    • https://s3.amazonaws.com/fovezewi/romanian_deadlift_form_smith_machine.pdfIn PDF document text
    • https://s3.amazonaws.com/nevovumowa/monalagimofobubolenala.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.