Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbc66797d40af4c5…

MALICIOUS

PDF

68.5 KB Created: 2021-02-27 09:12:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 657f87ed2a509f3833e857a60f2d95c7 SHA-1: 9ee2bb4d3e8acf0dd724d04a5465ef818018cdd6 SHA-256: fbc66797d40af4c5eea0479253f032ec32ed55e40cde8e513ef1a2700d8b5847
64 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a lure for a software download, indicated by the document body and an embedded URI pointing to a suspicious URL. ClamAV detection as 'Pdf.Phishing.Trojan' further supports malicious intent. The presence of embedded URLs suggests an attempt to redirect the user to a malicious site, likely to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.2415

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=fl+studio+12+free+download+full+version+32+bit PDF link annotation
    • https://tatazopizen.weebly.com/uploads/1/3/1/1/131163492/c01e779a2153.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454824/normal_5fc88a481045b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4478950/normal_6005380eacf12.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4468536/normal_5feb087616321.pdfIn PDF document text
    • https://s3.amazonaws.com/serogajugomiji/zegekokefazosuwiru.pdfIn PDF document text
    • http://wurunuj.epizy.com/63497979712.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.