Malicious PDF — malware analysis report

Static analysis result for SHA-256 eeb29a97ad7c41e7…

MALICIOUS

PDF

61.2 KB Created: 2021-05-09 09:21:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c04b2bf1bebe7b728fcd3596d46b6d67 SHA-1: 6ccec4f745e0db20fb1fc3aeb22ccecad8ff9db8 SHA-256: eeb29a97ad7c41e7bb21d11dc9afedaec438564129fdafd1fed6d24748cea295
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a signature indicating it is a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is a common tactic for phishing lures. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4988

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=what+are+the+4+sentence+structures
    • http://shoop-fg.ru/leap_day_gamezaia9.pdf
    • http://idealica-italiaofficial.site/growth_mindset_carol_dweckvcvo4.pdf
    • http://antileqphh.site/samsung_j200g_cf_auto_roothvrdg.pdf
    • https://cdn.sqhk.co/merabuvi/Cshchdd/lenovo_yoga_9i_availability.pdf
    • http://tixshopclub.fun/15068526258qal8e.pdf
    • https://vimiwakemimug.weebly.com/uploads/1/3/1/6/131606159/84801579ea1.pdf
    • http://trixy-matrix.space/pieta_prayer_book6sfif.pdf
    • https://xoxatazafej.weebly.com/uploads/1/3/4/8/134861408/viwewage_sazokaxefububo.pdf
    • https://burufazifefep.weebly.com/uploads/1/3/4/5/134584298/ed86a45a7241.pdf
    • https://cdn.sqhk.co/tobijoge/hfji7jf/fanekevofovugowajuvib.pdf
    • https://ropexosuwewi.weebly.com/uploads/1/3/1/3/131380205/691666b75ef055.pdf
    • https://kokubuzo.weebly.com/uploads/1/3/4/0/134017800/1dbef.pdf
    • https://cdn.sqhk.co/pejinijew/jeghjfr/47122521465.pdf
    • https://cdn.sqhk.co/xamitarerivu/gcHs3ge/55688768823.pdf
    • https://uploads.strikinglycdn.com/files/eadce517-1b93-4612-b2b5-d077fc1e59d6/patuk.pdf
    • https://ab25a8b3-4d80-4d4b-93a1-c1347014fa7c.filesusr.com/ugd/8d0191_c8540e5165e54bb8bcd0d793853c9d3b.pdf?index=true
    • https://s3.amazonaws.com/tafogusegabomu/the_tempest_study_guide.pdf
    • https://s3.amazonaws.com/xepululejiwof/was_call_me_by_your_name_taken_off_netflix_uk.pdf
    • https://uploads.strikinglycdn.com/files/06175e2a-4ad9-4c44-aa5b-dfa8a5835b83/teriramukinogorilut.pdf
    • https://7e073981-ad1c-4081-8dc0-76946ba36063.filesusr.com/ugd/c4f63d_08eeb9b451a94228b3f8c0005701ed6e.pdf?index=true
    • https://s3.amazonaws.com/sefukirexuwekij/sixirozuded.pdf
    • https://s3.amazonaws.com/megelugik/tv_program_uk_guide.pdf
    • https://s3.amazonaws.com/jigezilor/561288004.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.