Malicious PDF — malware analysis report

Static analysis result for SHA-256 e73c40efa3efc95d…

MALICIOUS

PDF

59.9 KB Created: 2021-03-30 03:31:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4968733fcdfdfcbee5561d4ffeadf23e SHA-1: 27553bba45061273d9d452792a75026b614276c0 SHA-256: e73c40efa3efc95d58afc06c4e437e5a40ccfd5c5648962fabf7b379fff2af43
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is identified as malicious by ClamAV and an ML classifier. The heuristic PDF_IMAGE_LURE indicates it's an image-only document designed to trick users into clicking an embedded URI. The primary external URI found is https://xajibur.ru/award?keyword=effects+of+unemployment+in+the+philippines+pdf, which likely serves as a phishing or malware distribution point. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8846

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 59 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=effects+of+unemployment+in+the+philippines+pdf
    • https://cdn.sqhk.co/fusajovogi/giijhje/castaway_bay_mario_party.pdf
    • https://cdn-cms.f-static.net/uploads/4454684/normal_605c288a0bc4c.pdf
    • https://cdn.sqhk.co/webepinovet/hiZ7jix/commander_cody_costume_target.pdf
    • https://cdn.sqhk.co/xoraxuvonaf/i8haOhf/rutisoxitedasizisudetu.pdf
    • https://nobopejulalajib.weebly.com/uploads/1/3/4/6/134621416/6176470.pdf
    • https://cdn.sqhk.co/rabataxuvax/giebSkn/firunakezuzozupidadibotim.pdf
    • https://cdn.sqhk.co/noruwotil/if9tw2P/92028691281.pdf
    • https://ninusava.weebly.com/uploads/1/3/1/4/131436980/kowazetigawux.pdf
    • https://cdn.sqhk.co/jabakujivim/jjejeX0/54846381839.pdf
    • https://cdn-cms.f-static.net/uploads/4471236/normal_602a504fbd4f8.pdf
    • https://cdn.sqhk.co/jirudumom/jbhjHji/ice_hockey_3d_mod_apk_download.pdf
    • https://cdn-cms.f-static.net/uploads/4467038/normal_604b5f7740cfd.pdf
    • https://rupokolox.weebly.com/uploads/1/3/0/8/130813141/3af7d.pdf
    • https://dafavazama.weebly.com/uploads/1/3/4/8/134893815/423053.pdf
    • https://cdn-cms.f-static.net/uploads/4407069/normal_5fd2b02b9b483.pdf
    • https://cdn-cms.f-static.net/uploads/4427783/normal_60521bca97d44.pdf
    • https://uploads.strikinglycdn.com/files/ebf267fb-d2f3-4f45-8517-c95ac7981b3e/mandeville_fable_of_the_bees.pdf
    • https://uploads.strikinglycdn.com/files/9aeb36d7-f3ca-4438-aa03-80cb12e6be26/wubolezagozu.pdf
    • https://uploads.strikinglycdn.com/files/cd9ac0f0-c120-4c81-93d6-cbc25c2e2640/asus_rt_ac87u_svensk_manual_reboot.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.