Malicious PDF — malware analysis report

Static analysis result for SHA-256 080c3e8d2b1d86d4…

MALICIOUS

PDF

70.9 KB Created: 2021-04-07 00:23:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2d56694451d9f86cb931bd32bd0c6840 SHA-1: 4ee27cfc181ecc67b736dca2628fec423dd31f25 SHA-256: 080c3e8d2b1d86d4be2b1296e64e33335a3b66cddf5718b467a7f2316183f624
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely serving as a lure for phishing or malware distribution. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest it's designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7234

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/award?keyword=calendario+noviembre+diciembre+2020+pdf
    • http://watogoda.mypressonline.com/27884594095.pdf
    • https://cdn.sqhk.co/goganededem/aajbgiu/pupajubaloz.pdf
    • https://cdn-cms.f-static.net/uploads/4388819/normal_602c53c5c3524.pdf
    • https://cdn-cms.f-static.net/uploads/4369760/normal_6025762ca5a7a.pdf
    • https://cdn.sqhk.co/danajuva/ahehgeo/doordash_promo_code_2020_mcdonalds.pdf
    • https://cdn.sqhk.co/koletexun/xAgghcm/90660690267.pdf
    • https://cdn.sqhk.co/zesonixiv/gjURR4P/72440322431.pdf
    • http://somubuzesixuwun.getenjoyment.net/94536020769.pdf
    • https://cdn.sqhk.co/semiwewedazi/06eCnz4/truck_vs_bus_racing.pdf
    • http://wewogokuwidu.mywebcommunity.org/37575020353.pdf
    • https://cdn-cms.f-static.net/uploads/4482188/normal_600f657d2b8f2.pdf
    • https://cdn.sqhk.co/ruwonumatag/5ojcrid/99140059730.pdf
    • https://cdn.sqhk.co/pibepufas/Lniguhe/monster_hunter_world_iceborne_fatalis_evil_eye.pdf
    • http://gomigapujasep.sportsontheweb.net/performance_budgeting.pdf
    • https://cdn-cms.f-static.net/uploads/4414360/normal_6023f31076099.pdf
    • https://cdn-cms.f-static.net/uploads/4367283/normal_6053e23ab0431.pdf
    • https://cdn.sqhk.co/runetonorox/ie5n9Ta/bottle_shoot_game_download_in_jio_phone.pdf
    • http://vexoxem.scienceontheweb.net/bibel_tv_programmheft.pdf
    • https://cdn.sqhk.co/texafikogot/eFUeqFF/transfer_sms_messages_android.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/056f93fb-05db-427d-92d6-90f8f31d56a0/xowadomijom.pdf
    • https://uploads.strikinglycdn.com/files/20aab35c-7f46-40c8-be50-e09e4caabe21/hampton_bay_ceiling_fan_light_not_working.pdf
    • http://farovosodiwes.atwebpages.com/38765406448.pdf
    • http://badamowafe.onlinewebshop.net/19450659179.pdf
    • https://uploads.strikinglycdn.com/files/a3f2fe21-03c6-4462-8259-03fcaf461696/how_to_fold_up_a_bowflex_power_pro.pdf
    • http://bavotuvezomevi.myartsonline.com/how_much_does_a_fitness_instructor_earn_in_canada.pdf
    • https://uploads.strikinglycdn.com/files/eef872e1-d078-49f4-bc12-2a995e27154a/pokemon_ultra_sun_wormhole_guide.pdf
    • https://uploads.strikinglycdn.com/files/cf801a29-299e-4fd6-8eee-b3b0b8ce284c/jowitanofigokalejal.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e176.bin
fdb16656bc078f5e4069600affba00a4c55fa604286e883eebf1e58155af7644		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE176 5500 bytes
font_01_sfnt_off0000f414.bin
7687d4cc0d122bd112c1e7cae3da8d52eec6cd270f21ae964579d44bbbf9c2a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF414 11964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.