Malicious PDF — malware analysis report

Static analysis result for SHA-256 0b709ab2791c0854…

MALICIOUS

PDF

57.4 KB Created: 2021-05-17 16:13:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 055036f93ae9ca8101b8d03f1df92a97 SHA-1: 73116ae76053dd9b9eca9243153fd3cbed1730f9 SHA-256: 0b709ab2791c08545235432af3324ad572eff97a6ffc465342b1d34ef9c4fe73
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to a suspicious URL, suggesting an attempt to download a secondary payload or redirect the user to a malicious site. The document body, though heavily obfuscated, contains references to 'magazine template publisher 2013' and 'wkhtmltopdf', likely part of a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8633

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cructi.ru/uplcv?utm_term=magazine+template+publisher+2013
    • http://vincityhomes.vn/wp-content/plugins/super-forms/uploads/php/files/dsk0m93ju9bq33ptelk0lh6amq/15514132969.pdf
    • http://aksaaydinlatma.com/img/editor/image/file/vuzonepivub.pdf
    • https://thejasmineway.net/wp-content/plugins/super-forms/uploads/php/files/9pmii6dq63n9kph9cngb1dvh20/22313438143.pdf
    • http://www.oknookna.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16090b56147c33---42484810352.pdf
    • https://gz-topstar.com/wp-content/plugins/super-forms/uploads/php/files/e2da4022d7ce6ecd776ef983353d60aa/pizopasuxuwinerufivukinu.pdf
    • https://alignerco.com/wp-content/plugins/super-forms/uploads/php/files/700c5a93204f0f2c7ac812bbc892fb1d/tilefukufawus.pdf
    • http://www.tobywells.org/media/fckdir/file/bisozivenoxanobofezunu.pdf
    • http://beergolfers.com./blog/images/file/tefinubovapojamagexizuw.pdf
    • https://mindweave.co.uk/wp-content/plugins/super-forms/uploads/php/files/fi272bk3eecqlhnn29prnq0jgu/27993174034.pdf
    • https://veritiesinstitute.com/wp-content/plugins/super-forms/uploads/php/files/6a0d4f7cabfe051ee1794ac77d1a41dc/35728504844.pdf
    • http://rusiuojigalvoji.lt/wp-content/plugins/formcraft/file-upload/server/content/files/16082e074e70f5---vejufujogewigamitevijefuz.pdf
    • https://www.officinadelgustoroma.com/wp-content/plugins/super-forms/uploads/php/files/46214589aa8cc96abf44d60e78dd5dc2/zazitudabek.pdf
    • http://maychamsocda.vn/images/userfiles/file/60924405861.pdf
    • http://skup-laptopow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608ec92388750---84642575869.pdf
    • https://ancoraeducacion.com/images/88339803691.pdf
    • https://interesttour.com/wp-content/plugins/super-forms/uploads/php/files/8d743635702053b259d1e1048bb284a4/27574898987.pdf
    • http://modelkyujin.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609498c6c3193---sibatumolologodokisup.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6c9.bin
9af8d0a1571e17fa49dc4dcbd001aac576acdd2f95b3309bba697e0822b5ed68		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD6C9 5920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.