Malicious PDF — malware analysis report

Static analysis result for SHA-256 0099a73578d3b48e…

MALICIOUS

PDF

58.9 KB Created: 2021-05-16 19:00:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2ecb3b5109d04293e216280334c5862f SHA-1: eaa2fd38686b46ee18ec6f017dfbce802968e661 SHA-256: 0099a73578d3b48e37372c9f4eabce537e75877a2179b84b1b8a6e9bafc7de60
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains embedded URLs that likely lead to further malicious content or phishing pages. The document body, though heavily obfuscated, suggests a lure related to 'Aspiration system design guide', aiming to trick users into visiting these external links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9739

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://audiomaster.se/wp-content/plugins/formcraft/file-upload/server/content/files/16071d322b599d---98240112945.pdf
    • http://windcampus.com/wp-content/plugins/formcraft/file-upload/server/content/files/16091f13db7da9---pilagodogefoxivedunov.pdf
    • https://finestblogger.de/wp-content/plugins/super-forms/uploads/php/files/6aruddn1qvev237bfk3446jfi2/fuvejuf.pdf
    • https://alutat.com/data/file/telak.pdf
    • https://yziact.fr/wp-content/plugins/super-forms/uploads/php/files/1tp80tkqev3erogqhnvombq9l2/1255625261.pdf
    • https://www.histoiresdegroupes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f8b208c1ed---bazivogev.pdf
    • https://murderescape.com/wp-content/plugins/super-forms/uploads/php/files/875e8d101908bc949338bc5896dd96cc/vavepunes.pdf
    • https://ivfnna.gr/wp-content/plugins/super-forms/uploads/php/files/036f169a104a8a621d99b04201a03ca0/rifijo.pdf
    • http://www.lbf-cosmetics.com/website/wp-content/plugins/formcraft/file-upload/server/content/files/160903af398079---memexenazefo.pdf
    • https://bykevin.com/wp-content/plugins/super-forms/uploads/php/files/9e0ce0778c0697d04002b26de0b973cd/81941846973.pdf
    • http://www.alwaysflorida.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c9090507b8---91303450719.pdf
    • https://bodwellassociates.com/wp-content/plugins/super-forms/uploads/php/files/a20d622d3acaa467ac0245d759115474/nexiruwodinog.pdf
    • http://theydeserveastamp.org/wp-content/plugins/formcraft/file-upload/server/content/files/16099e8be024f0---moxabivoberot.pdf
    • http://broadviewlibrary.org/uploaded_bvlib/file/kutixakogifuj.pdf
    • https://maidintown.co.uk/wp-content/plugins/super-forms/uploads/php/files/e10b2f02a4a03595d943f83944b67f1c/13309736011.pdf
    • https://alkhairi.co.uk/wp-content/plugins/super-forms/uploads/php/files/03632cebeba58a4d3af35a526ca941a0/womaziruna.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/skout/mBVl/~3/1KS0DP0cxss/uplcv?utm_term=aspiration+system+design+guide
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d98c.bin
134fafb29fb463d5df0146ddececc2eeac2c1eec33be6fd70fb24075f34372be		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD98C 5340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.