Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff47031cfad64962…

MALICIOUS

PDF

50.6 KB Created: 2021-03-23 06:04:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5eed253ae087e4d554e9d6b0a0c60644 SHA-1: c29dd05f25388294ea23d76db0d81bc89d261205 SHA-256: ff47031cfad64962657958f3bedb42aa1b7145f5de6a6722a2fe845344b320f2
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as malicious by ML classifiers and ClamAV, and exhibits characteristics of a phishing lure due to its small size and image-heavy content. It contains an embedded URI pointing to 'https://maypoin.ru/aws?utm_term=how+long+does+kindle+fire+battery+last', which is likely the malicious destination. No scripts were extracted, but the PDF structure and heuristics suggest an attempt to trick the user into navigating to a harmful external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9328

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/aws?utm_term=how+long+does+kindle+fire+battery+last
    • http://optarfes.com/python_dictionary_example_stackoverflowt5yqt.pdf
    • http://perevod24-card2card.site/34001569583x46id.pdf
    • http://lynciguest.com/freely_freely_you_have_received_sheet_musicztsds.pdf
    • http://probkin34.xyz/which_samsung_tv_has_bluetooth8rlfv.pdf
    • http://aicberg.net/27904166965fm17m.pdf
    • http://hangookoil.ru/what_does_abstract_mean_in_a_reportj7xr7.pdf
    • http://lifokuvaxodime.iblogger.org/29907313728.pdf
    • http://stassikorskyi.com/zekamukefekaxu0c3kq.pdf
    • http://f1l3download.site/congenital_heart_disease_echocardiography_guidelinesduqff.pdf
    • https://uploads.strikinglycdn.com/files/fe4f2f0d-0512-4189-8688-4fbf4088a459/65613218696.pdf
    • https://uploads.strikinglycdn.com/files/5ffe43ff-9f43-427c-b601-a1fff47a65f6/xapisowupezedepuzonaverib.pdf
    • https://s3.amazonaws.com/fejififimaketo/tennessee_comptroller_reports.pdf
    • http://tinosizifaxuful.epizy.com/44137878025.pdf
    • http://bolapapuziku.epizy.com/alchemia_story_japan_apk.pdf
    • https://s3.amazonaws.com/kubafezin/didriksons_size_guide.pdf
    • https://uploads.strikinglycdn.com/files/bba0309c-8b54-499a-a4cc-aa80de28181a/5453232060.pdf
    • https://uploads.strikinglycdn.com/files/bbb211ad-b3de-4f97-969a-436ba53462bd/pizirexusuridepetaliv.pdf
    • https://uploads.strikinglycdn.com/files/5268bad4-6e2f-4a20-a193-deb259edc70a/verizon_jetpack_activation.pdf
    • http://tusuzexuwijoki.rf.gd/97376360822.pdf
    • http://xitivorigafu.epizy.com/39843026203.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.