Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0ea65b31baea81d…

MALICIOUS

PDF

44.9 KB Created: 2021-03-19 05:22:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 6acc3a4dbf6a131b2fac31a04d852730 SHA-1: b49ed1eaacfcc3627105592584af4437374065a0 SHA-256: f0ea65b31baea81da4891e7280144e4316ac02932259366bc762c9bc765c001c
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8132

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=kehinde+buchi+emecheta+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4481834/normal_6019730c1f8d3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388432/normal_601efd3872d4d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465705/normal_5fc74b964355c.pdfIn PDF document text
    • http://kenozajawatulaw.rf.gd/working_of_biomass_power_plant.pdfIn PDF document text
    • https://167c8e7b-8160-49a2-a88e-f26749d647c8.filesusr.com/ugd/1ad47d_6dc4c5f08f97416f8eb4318e89b1c822.pdf?index=trueIn PDF document text
    • http://famuruvif.epizy.com/macedonian_news_mina_report.pdfIn PDF document text
    • https://s3.amazonaws.com/turip/wisefaji.pdfIn PDF document text
    • https://s3.amazonaws.com/sulasatevirexo/samsung_un32j4000_specifications.pdfIn PDF document text
    • https://s3.amazonaws.com/wowonesoribu/51595629044.pdfIn PDF document text
    • https://s3.amazonaws.com/dutimajizowa/55638532333.pdfIn PDF document text
    • https://s3.amazonaws.com/rewepalazamiso/comprehensive_medical_report_example.pdfIn PDF document text
    • https://s3.amazonaws.com/rujimidujek/quantico_episode_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/bipepezuwed/pewusukomifuxivuroripobun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abc273c7-15e3-4583-a485-9f66144f148c/how_do_you_clean_a_hoover_smartwash.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e135455-7c16-4ca5-b3d5-15980b24d8f1/repigugumezituk.pdfIn PDF document text
    • https://0a497e50-07dd-462d-832d-d8678f741a8e.filesusr.com/ugd/5f857b_59d3bd2da97f42548375567a37ff9627.pdf?index=trueIn PDF document text
    • https://720c7b34-a033-4bf0-83ea-6be17de98aa2.filesusr.com/ugd/03ef8e_3fa952227b6743429d7f6508bb23fe9a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc9414b0-d2d2-40b3-bfc9-88b49dc8cf38/wibokuxuvefubovogumejawe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88f083a0-dd62-44c2-b2cd-616e41c89433/diwozobexej.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06d26917-d7d5-4d8d-bb7e-d2fb64eb122e/betijasetaveduduwewuxeru.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.