Windows Analysis Report
ACH Electronic Remittance Reciept.pdf

• HCA enabled
• EGA enabled
• AMSI enabled

• Found application associated with file extension: .pdf
• Found PDF document
• Close Viewer

```json
{
  "riskscore": 9,
  "reasons": "The PDF contains a visually prominent QR code with a 'SCAN ME' button, which encourages the user to scan it with their smartphone. The text 'SCAN QR CODE WITH YOUR SMART PHONE CAMERA TO OPEN SENSITIVE DOCUMENT' creates a sense of urgency and interest. The document impersonates a well-known brand, 'Microsoft Authenticator,' which adds to its credibility and potential to mislead users. The combination of urgency, interest, and brand impersonation significantly increases the risk of phishing or malware distribution."
}

```json
{
  "phishing_score": 9,
  "brands": "Microsoft",
  "phishing": true,
  "suspicious_domain": true,
  "has_loginform": true,
  "has_captcha": false,
  "setechniques": true,
  "has_suspicious_link": false,
  "legitmate_domain": "microsoft.com",
  "reasons": "The URL 'https://iexeuniversidad.com' does not match the legitimate domain 'microsoft.com' associated with the Microsoft brand. The webpage displays a login form asking for email and password, which is a common tactic in phishing attacks. The domain name 'iexeuniversidad.com' appears unrelated to Microsoft, raising suspicion. The use of the Microsoft logo and branding on an unrelated domain is a social engineering technique aimed at misleading users. There is no CAPTCHA present, which is often used on legitimate login pages for added security. Based on these factors, the site is highly likely to be a phishing site."
}