Malicious PDF — malware analysis report

Static analysis result for SHA-256 eb8581cc81c6e88c…

MALICIOUS

PDF

53.1 KB Created: 2021-03-22 15:13:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bcc260defa4293483cabd73a6ed1c8a7 SHA-1: 4359b55def39497dfe59fb6c648b5484de87a1a9 SHA-256: eb8581cc81c6e88ca1e72debc12120d7a2567ab2bdaec8a092695e9565013397
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a phishing lure due to its image-only nature and the presence of an external URI. The heuristic 'PDF_IMAGE_LURE' indicates a typical phishing shape where a screenshot hides a clickable button. The embedded URL 'https://gimoguvi.ru/award?keyword=wedding+budget+planner+pdf' is likely the destination for this lure, aiming to trick the user into downloading further malicious content or providing sensitive information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6852

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 53 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=wedding+budget+planner+pdf
    • https://jedadizonavo.weebly.com/uploads/1/3/4/7/134721040/vizegok_rizegeta_pejibuvog_guzulakuto.pdf
    • http://presalon.xyz/what_is_the_main_changes_iatf_and_ts_169496u7po.pdf
    • http://mgacessoria.online/mikuzetuwes92p1d.pdf
    • http://natbeach.space/kemikejyknjg.pdf
    • http://yourdesk.website/how_to_make_money_gta_v_online_pc2z156.pdf
    • http://vizionsmc.net/cellars_of_the_infernog72rn.pdf
    • http://mivetofim.22web.org/new_bhajan_pagalworld.pdf
    • https://gebaxugore.weebly.com/uploads/1/3/4/5/134594027/defabojaxaf.pdf
    • http://reduslimitalia-ufficiale.site/pusudowotujived4d31h.pdf
    • http://autobuff.xyz/power_pressure_cooker_xl_manual_rice12kad.pdf
    • http://hookup673.site/haar_wavelet_transform_matlab_codefpry8.pdf
    • https://nalufubuxozukex.weebly.com/uploads/1/3/4/4/134479837/25c45d297a.pdf
    • http://tehnopolis.org/harman_kardon_onyx_studio_4_user_manualk5mki.pdf
    • https://ponuxarazuzega.weebly.com/uploads/1/3/5/3/135328107/ziruwojoseju-dorebiwixugu-kovafakawig.pdf
    • https://mefixakiderix.weebly.com/uploads/1/3/4/3/134319494/wevogutabodasidivev.pdf
    • https://6129906d-bc82-46a7-99f5-71793a58af3c.filesusr.com/ugd/d162e3_d3b2100aef004ef9bdedabd92adf742b.pdf?index=true
    • https://68e1e3d4-268d-49bc-a8aa-b119cb10fea7.filesusr.com/ugd/3ceeb9_666c42790d684c91b87527c1a371e3a4.pdf?index=true
    • https://50037ee0-0691-4a53-bdc2-b2f8f795cfa6.filesusr.com/ugd/b41a9a_9c153f5652864465bed2cc63e5756dad.pdf?index=true
    • http://dipulitexaxuz.epizy.com/web_application_security_assessment.pdf
    • https://4abf464d-34d5-4c80-8de5-e64f30e04530.filesusr.com/ugd/8b3eb5_989ad188495c4bcea6547cdd3e8e2de3.pdf?index=true

Open this report in the interactive analyzer, or submit your own file for analysis.