Malicious PDF — malware analysis report

Static analysis result for SHA-256 e5a563db2fed66ef…

MALICIOUS

PDF

48.6 KB Created: 2020-12-10 08:55:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3e70c7d28c4014c51b92a2625c17e56b SHA-1: fb1772e6f04e91ac5a89ed1dea9b1b340bc1e376 SHA-256: e5a563db2fed66eff1b1148cdb918ef4d7105e1a6445f60863092f09849e9778
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as malicious by ClamAV and an ML classifier, and it exhibits characteristics of a phishing lure. The heuristic 'PDF_IMAGE_LURE' indicates it's an image-only document with a clickable action, typical for phishing. The embedded URL points to a suspicious domain, likely serving as the next stage in the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7360

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 48 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/strik?utm_term=aag+2020+paris
    • https://cdn-cms.f-static.net/uploads/4480414/normal_5fbfdb721c870.pdf
    • https://cdn-cms.f-static.net/uploads/4470207/normal_5fa89f2898d4d.pdf
    • https://cdn-cms.f-static.net/uploads/4484995/normal_5fb25bcdb621b.pdf
    • https://cdn-cms.f-static.net/uploads/4374366/normal_5f9665a3d137e.pdf
    • https://static.s123-cdn-static.com/uploads/4374986/normal_5fc5eb13384cb.pdf
    • https://cdn-cms.f-static.net/uploads/4366317/normal_5f93a3251c173.pdf
    • https://static.s123-cdn-static.com/uploads/4401971/normal_5fc4c81bb02c2.pdf
    • https://cdn-cms.f-static.net/uploads/4421478/normal_5fb5b19f69409.pdf
    • https://cdn-cms.f-static.net/uploads/4365657/normal_5fbc354223b2c.pdf
    • https://cdn-cms.f-static.net/uploads/4443799/normal_5fbaabc0bd96f.pdf
    • https://uploads.strikinglycdn.com/files/5018e172-e63a-4292-82f6-6b7cecf6d311/peresemirasekukolubunatu.pdf
    • https://static1.squarespace.com/static/5fc553571c8c7413144f5d77/t/5fc80e60d6b05e265280f5fc/1606946402814/cannonball_run_record_car.pdf
    • https://s3.amazonaws.com/bawalidamovidud/main_balwan_picture.pdf
    • https://uploads.strikinglycdn.com/files/55808156-e694-47da-8242-e4e975cefe25/gymboree_class_schedule_toco_hills.pdf
    • https://s3.amazonaws.com/xidulumexi/citra_android_not_working.pdf
    • https://static1.squarespace.com/static/5fc583dfa879396864276626/t/5fcea747c463130800a386de/1607378759865/wavujifonojalebufagaputix.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.