PDF malware analysis — malicious · 155e080364157267

MALICIOUS

PDF

69.5 KB Created: 2021-03-06 00:46:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18

MD5: 641ef59138fce7aeff81e5516b9c8887 SHA-1: b551f1595ac0c8e0a66818b19c42925ac5bacf42 SHA-256: 155e0803641572676c3a4ef501d268b73e6b59a2866d7a13298e7eefa6e49b89

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.8223

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://soxebez.ru/award?keyword=how+to+get+a+job+as+a+motorcycle+mechanic PDF link annotation
- https://cdn.sqhk.co/nizufalagef/d5S4Kdw/fevijazidusivuruzupug.pdfIn PDF document text
- https://cdn.sqhk.co/nenakowi/wljjJsu/vampires_wife_cape_h_m.pdfIn PDF document text
- https://cdn.sqhk.co/wotinobeb/jScESie/mtx_gp_apk_download.pdfIn PDF document text
- https://cdn.sqhk.co/tibidimewako/i2JjaDD/adventure_capitalist_hack_steam.pdfIn PDF document text
- https://cdn.sqhk.co/sirijunubi/KjziaM3/gba_emulator_pro_apk_uptodown.pdfIn PDF document text
- https://cdn.sqhk.co/kunimanujage/0gcQger/storm_radar_hurricane_tracker_live_maps_alerts.pdfIn PDF document text
- https://cdn.sqhk.co/sovokeduseb/KapkhjG/sad_video_status_download_in_tamil_share_chat.pdfIn PDF document text
- https://cdn.sqhk.co/vekepafate/eEhdicj/racing_in_car_2_game_free_download.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/4f88ebdd-6591-448c-b9d7-e57e3250aec2/dark_alliance_ps2_cheats.pdfIn PDF document text
- https://s3.amazonaws.com/fulazelof/schwinn_bike_computer_tire_size.pdfIn PDF document text
- http://fojeropiralamab.rf.gd/man_after_man_an_anthropology_of_the_future_by_dougal_dixon.pdfIn PDF document text
- https://s3.amazonaws.com/lusabifef/safety_first_car_seat_and_stroller_combo.pdfIn PDF document text
- https://s3.amazonaws.com/polexebuj/bully_2_pc.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/39e3aa79-7de2-43c1-9bce-03112809be9c/lenuzaxefirozuxiso.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f2731e3c-276a-46c0-a48f-89bfcce9d4dd/samsung_galaxy_note_3_neo_price_philippines.pdfIn PDF document text
- http://nivosifif.rf.gd/focus_group_guideline_example.pdfIn PDF document text
- http://diwukimip.epizy.com/lokerogaladedivazevudi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2a4e4ee9-c33c-4cbf-b2ac-ef5650a6245d/how_to_reset_my_la_crosse_weather_station.pdfIn PDF document text
- https://s3.amazonaws.com/rubidokezive/vezirorosexewimed.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d2b41773-930f-44f6-a331-661c50e41ee4/19578610919.pdfIn PDF document text
- https://s3.amazonaws.com/jesidofefe/69209469194.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ffa7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFFA7	5584 bytes
SHA-256: `200e5974cccbed4cac026232141dbfb8c8918a5d4bd596a836d50ae988999a0e`

Open this report in the interactive analyzer, or submit your own file for analysis.