Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef9b7e6c7aa51909…

MALICIOUS

PDF

48.5 KB Created: 2021-09-02 08:07:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05
MD5: c5addd5e384c37d568008cbb53992b46 SHA-1: 0552a0be3c80b0a52a89470d1ef94346ed06d917 SHA-256: ef9b7e6c7aa5190957692364237d4d75a4730cbd9c8960e70eb8ca00dc41a0df
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5106

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://salondebellezaanamariaromero.es//ckfinder/userfiles/files/80468761550.pdf In PDF document text
    • http://lustigersteirer.at/userfiles/file/91247293789.pdfIn PDF document text
    • https://5udua.com/contents/files/murobijakor.pdfIn PDF document text
    • http://yuanjen.com/ckfinder/userfiles/files/zowejugiduwesadolez.pdfIn PDF document text
    • http://birons.net/wp-content/plugins/super-forms/uploads/php/files/bbf19cff742e76ca06b0b51fbc4acc41/32609363609.pdfIn PDF document text
    • https://desertflying.club/wp-content/plugins/formcraft/file-upload/server/content/files/160d6457734f90---51921683076.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=another+word+for+suggests+in+an+essayPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.