Malicious PDF — malware analysis report

Static analysis result for SHA-256 f79ceac1ae96a475…

MALICIOUS

PDF

45.7 KB Created: 2021-09-02 03:54:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-02
MD5: 7427cf2cf2f3b7a9d09ed354e54544a5 SHA-1: 7de8b6990d7601c8d5f3da014ded3db808d0f433 SHA-256: f79ceac1ae96a475308d15b4c4271d11cd60eaa501891ed48d0eff568f7aeba4
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7713

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nationalshield-uae.com/userfiles/files/67357921422.pdf In PDF document text
    • http://csc0351.com/userfiles/file/20210612223840_6vuhgd.pdfIn PDF document text
    • http://controldellaves.com/app/webroot/arxius/file/44116314611.pdfIn PDF document text
    • http://savitaco.com/uploads/images/files/xovavavamivimikilovu.pdfIn PDF document text
    • https://emauto.lv/index/images/up/file/45950220036.pdfIn PDF document text
    • http://inlikeflintlogistics.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a06aa549bef---rimenosuwi.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=perineal+support+during+deliveryPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.