Malicious PDF — malware analysis report

Static analysis result for SHA-256 09d221056a4dfa12…

MALICIOUS

PDF

200.7 KB Created: 2021-03-09 08:09:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 86200582d3a9e79967d82f8294bf580b SHA-1: 0e770b10eb1043b72db1998448a94c559b9666a8 SHA-256: 09d221056a4dfa12e87ac5e1b23e9835f6c887b6969dd87158b17e15d6e0328b
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5021

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=qasida+burda+full+pdf PDF link annotation
    • http://lologunaw.mygamesonline.org/37145201241.pdfIn PDF document text
    • http://skout.tech/is_narnia_prince_caspian_on_netflix4t1pg.pdfIn PDF document text
    • http://dom-bita.org/sony_playstation_4_slim_500gbtle8l.pdfIn PDF document text
    • http://bumosid.getenjoyment.net/aa_twelve_traditions_explained.pdfIn PDF document text
    • http://kovuzaxaf.medianewsonline.com/resumen_de_el_libro_de_los_muertos_egipcio.pdfIn PDF document text
    • http://cashfree.store/shinee_ring_ding_dong_ringtonewf6s4.pdfIn PDF document text
    • http://tesidakikize.iblogger.org/bing_maps_3d_apk.pdfIn PDF document text
    • http://fezelegafefuv.mywebcommunity.org/felelogixunadefuz.pdfIn PDF document text
    • http://sevowina.medianewsonline.com/kamiduna.pdfIn PDF document text
    • http://replyua.site/awm_sniper_soundux1jm.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/rimepusox/becosules_performance_capsule_ingredients.pdfIn PDF document text
    • http://jatoxat.atwebpages.com/64454167994.pdfIn PDF document text
    • http://konevimojo.epizy.com/format_date_in_sql_report_builder.pdfIn PDF document text
    • https://s3.amazonaws.com/kovezux/26488811470.pdfIn PDF document text
    • http://sexuvariv.epizy.com/walepadaf.pdfIn PDF document text
    • https://s3.amazonaws.com/xilasisefi/airserver_android_tv.pdfIn PDF document text
    • https://s3.amazonaws.com/bisazabe/gudumujukowazufi.pdfIn PDF document text
    • http://gaxilitexu.onlinewebshop.net/el_coronel_no_tiene_quien_le_escriba_para_descargar.pdfIn PDF document text
    • https://s3.amazonaws.com/zowejunef/dodgeball_film_parents_guide.pdfIn PDF document text
    • http://xavisijividefo.epizy.com/72470929300.pdfIn PDF document text
    • https://s3.amazonaws.com/fefurorobumi/utilitarianism_theory_of_justice.pdfIn PDF document text
    • http://jowokepo.atwebpages.com/fisolepa.pdfIn PDF document text
    • https://s3.amazonaws.com/fakuguvil/15753078889.pdfIn PDF document text
    • http://todidetiped.onlinewebshop.net/the_very_busy_spider_activities_eyfs.pdfIn PDF document text
    • https://s3.amazonaws.com/vuforewebub/doin_your_mom_sheet_music.pdfIn PDF document text
    • https://s3.amazonaws.com/loranoduzuja/rifubiduv.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0003077a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3077A 13857 bytes
SHA-256: 90d6ff8d7765cb4f5094a771950027d182487cde245beda19c662df394f63faf
font_00_sfnt_off0002d063.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D063 5236 bytes
SHA-256: 2a91e2e47a30cad8ab22fd5a9011405f5c89633da8fe3e056bc014aae0bf3f40
font_01_sfnt_off0002e234.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E234 11376 bytes
SHA-256: 3740e658c74c08f5104ecf1349ed7b32a5228090809bdd3caffe56adccfc1525

Open this report in the interactive analyzer, or submit your own file for analysis.