Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d40fd148beeda13…

MALICIOUS

PDF

58.6 KB Created: 2020-12-26 03:55:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: a5365fa5a0fcc84ca43fdd40d8f832ee SHA-1: 83b4d9ec6403d3ba6192e660c7034513346cbd57 SHA-256: 0d40fd148beeda13097e570db84661f207f9eba9821832032b952d80c032c735
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8639

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=the+othello+effect PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4479210/normal_5fc203a55d7ab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389582/normal_5fd9b82b7bd6b.pdfIn PDF document text
    • https://bekijarodik.weebly.com/uploads/1/3/4/6/134617997/negasezufit.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4427506/normal_5fe4919f9f599.pdfIn PDF document text
    • https://saxibodusazo.weebly.com/uploads/1/3/0/7/130740440/2169787.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405945/normal_5f938ae846482.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482189/normal_5fdf811dc8c0c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f6245ed9-4fa7-4bfb-8c33-d2a8177ff71c/49168958873.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba087892-6ec1-4311-9245-f1e29bac0693/interstellar_piano_sheet_music.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6bf44299-488d-40dd-be5e-836d7e202da7/adobe_photoshop_fix_apk_pro.pdfIn PDF document text
    • https://s3.amazonaws.com/xilasisefi/geometry_worksheets_printable_high_school.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0443a101-275b-467f-a14c-9b6d1abf9961/20201861764.pdfIn PDF document text
    • https://s3.amazonaws.com/pivetuzadujo/37444280305.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/296c13a9-7808-46e1-92cb-9b2d6989167d/71442004672.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df61.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF61 4436 bytes
SHA-256: 764fe8b42234eb485c6ba62039fd4caf2bada440a20a8d29ca37d0e26cf23351

Open this report in the interactive analyzer, or submit your own file for analysis.