Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8cf30fe723eff76…

MALICIOUS

PDF

65.6 KB Created: 2021-02-26 20:45:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: ff4c72fe700338069dd5ef01fd44fa4d SHA-1: 7ddf3c5de7b9f1aa027502edc80ce09829bc4721 SHA-256: d8cf30fe723eff765c8f4c4e7523ea39f2a535fc91a52d8c45cfe2cfebb03671
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF document that contains an embedded URL disguised as a search result. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. The embedded URL, https://nipisod.ru/aws?utm_term=best+handheld+game+for+8+year+old, is the primary indicator of compromise, suggesting a lure to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9578

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/aws?utm_term=best+handheld+game+for+8+year+old PDF link annotation
    • https://cdn.sqhk.co/zabitokepum/CGigpmq/rowalubokudotiwepor.pdfIn PDF document text
    • https://cdn.sqhk.co/zakolemafemo/jjt1Sjc/content_transfer_app_not_working.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480170/normal_5fede49d3253e.pdfIn PDF document text
    • http://lajenasuwo.iblogger.org/selivorak.pdfIn PDF document text
    • http://ruzojonawa.epizy.com/mufajabolinaxit.pdfIn PDF document text
    • http://ninivekav.rf.gd/what_is_the_ip_address_of_wd_my_cloud.pdfIn PDF document text
    • https://s3.amazonaws.com/widiku/gotiduditorojulozub.pdfIn PDF document text
    • https://s3.amazonaws.com/tuletivotarupu/ganezed.pdfIn PDF document text
    • http://zavujosabojid.rf.gd/noidaauthorityonline_application_form.pdfIn PDF document text
    • https://s3.amazonaws.com/votubukaxogilix/bangla_movie_audio_song_free.pdfIn PDF document text
    • http://fanulegosupilul.rf.gd/22547887262.pdfIn PDF document text
    • https://s3.amazonaws.com/tupofelasujewas/my_voicemail_password_android.pdfIn PDF document text
    • https://s3.amazonaws.com/mojivikapeti/64804914905.pdfIn PDF document text
    • http://fojiguxojed.epizy.com/59362297761.pdfIn PDF document text
    • http://badetez.epizy.com/jagutuvelim.pdfIn PDF document text
    • https://s3.amazonaws.com/tajimipojimo/nutritional_biochemistry_textbook_free.pdfIn PDF document text
    • https://s3.amazonaws.com/wixanarer/definition_of_heat_of_formation_in_chemistry.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.