Malicious PDF — malware analysis report

Static analysis result for SHA-256 0acf80be094a3472…

MALICIOUS

PDF

73.5 KB Created: 2021-03-14 11:14:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e0d16317d4abd68a2a0bd1bf941178ae SHA-1: f32c11c5eb9cbc7ff6e6409a208c43e14841fd4d SHA-256: 0acf80be094a34722d55743d30af7b0da63fe5ecddbb8fd4eddae841c6eb27e9
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, vilenefex.ru, which is likely part of a phishing or malware distribution scheme. ClamAV and ML classifiers also flagged this PDF as malicious. The document body, though heavily obfuscated, contains text fragments that suggest a lure related to 'old soul music free', aligning with the malicious URL's parameters.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8829

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=old+soul+music++free
    • http://sis-paypal.com/barcode_generator_software_free_with_crackti8og.pdf
    • http://tufofol.medianewsonline.com/el_nombre_del_viento_3_fecha.pdf
    • http://degujub.iblogger.org/a_speakers_guidebook_text_and_reference_6th_edition.pdf
    • http://dunodipike.sportsontheweb.net/cambodian_alphabet.pdf
    • http://finipupote.mywebcommunity.org/yiruma_piano_sheet_music_book.pdf
    • http://zebrait.fun/22504072398kzx3e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/genijusemu/panasonic_phone_battery_hhr-p105.pdf
    • https://s3.amazonaws.com/jujojomojemiz/factoring_polynomials_using_algebra_tiles_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/45c83f5e-ac1c-49c5-89c2-0372466bdf0b/runaway_alice_munro_quotes.pdf
    • https://s3.amazonaws.com/zuguvoxoki/what_are_the_goals_of_punishment_sentencing.pdf
    • https://uploads.strikinglycdn.com/files/bf4614e6-e7cd-4ee4-9900-b3bc8ecb0e6d/rekib.pdf
    • https://uploads.strikinglycdn.com/files/16645cbe-f799-41c8-95e5-95dbe81fc9d5/when_you_hate_being_the_center_of_attention.pdf
    • http://rinejifivazori.epizy.com/62766013473.pdf
    • https://s3.amazonaws.com/pafexegud/99131396868.pdf
    • https://s3.amazonaws.com/wupuxus/tone_poem_definition_art.pdf
    • https://s3.amazonaws.com/silubebebefuju/jigajofirefogevuziguvove.pdf
    • http://lamekukibudinos.epizy.com/executive_summary_quarterly_report_example.pdf
    • https://s3.amazonaws.com/juzewojavomofew/38184899748.pdf
    • https://s3.amazonaws.com/lovomijelun/bmw_bike_photo_hd.pdf
    • http://jeloneliva.epizy.com/bomberman_land_touch_2_apk.pdf
    • http://rulamiji.onlinewebshop.net/kuzabedosanetaj.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1a1.bin
c3df667cc0f120951d541b4ca9f1a7577ce74f4233e414e1a3995d5d8ae11b1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1A1 4984 bytes
font_01_sfnt_off00010281.bin
5adaa5ed0270c4cf26e062690985d2e4b0bce9c8bd094f0f7022efc2d52de7fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10281 11328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.