PDF malware analysis — malicious · 16e37fab611df410

MALICIOUS

PDF

70.8 KB Created: 2021-05-23 01:41:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25

MD5: 0b348dc54d7b0585cc3d5cdb7a3ee74d SHA-1: 45c5fec462dcdfe6e5b440163a5f5f444edbc72e SHA-256: 16e37fab611df410ee1a83bbeaf72db93246c9d75f1354fb58f289a92c0dfee9

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URL that redirects to a suspicious domain, likely as part of a phishing or malware distribution scheme. The document's content and the presence of an external URI strongly suggest a phishing attempt to trick users into visiting a malicious site. The ML classifier and ClamAV detection further confirm the malicious nature of the file.

Machine Learning

Nyx PDF Classifier malicious score 0.9906

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://soxebez.ru/strik?utm_term=how+to+send+bigger+videos+on+discord PDF link annotation
- https://cdn-cms.f-static.net/uploads/4414495/normal_6062482479b3e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4401519/normal_6007a07399505.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4374853/normal_5fcbc0c4d2cb2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4388432/normal_60519e5ad64fd.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4453747/normal_5ffe261d36d8c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365646/normal_60618e0fcf205.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/pafexegud/35049829432.pdfIn PDF document text
- https://s3.amazonaws.com/jafujasiwetid/que_funcion_tienen_los_medios_de_comunicacion_en_las_relaciones_interpersonales.pdfIn PDF document text
- https://s3.amazonaws.com/bededuxotulapil/decimal_places_worksheet.pdfIn PDF document text
- https://s3.amazonaws.com/jasipefulaxiduj/how_many_sheets_in_a_workbook_vba.pdfIn PDF document text
- https://s3.amazonaws.com/kukupunopedon/the_rules_of_basketball.pdfIn PDF document text
- https://s3.amazonaws.com/gapuruxumeg/pokemon_go_lure_evolution_guide.pdfIn PDF document text
- https://s3.amazonaws.com/votawawo/what_can_i_do_with_a_business_management_and_marketing_degree.pdfIn PDF document text
- https://s3.amazonaws.com/wujixus/7118784863.pdfIn PDF document text
- https://s3.amazonaws.com/vuzotisenixava/lg_hbs-750_how_to_pair.pdfIn PDF document text
- https://s3.amazonaws.com/xirixepo/information_technology_classification_standard.pdfIn PDF document text
- https://s3.amazonaws.com/seriposuj/1970_massey_ferguson_165_weight.pdfIn PDF document text
- https://s3.amazonaws.com/xukanomarexumu/vupodavasamoti.pdfIn PDF document text
- https://s3.amazonaws.com/divikufifir/45041971226.pdfIn PDF document text
- https://s3.amazonaws.com/solonebosop/amiri_build_guide.pdfIn PDF document text
- https://s3.amazonaws.com/povodijirig/83987412084.pdfIn PDF document text
- https://s3.amazonaws.com/tiniruru/dizokodikajifisovukamuzip.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f019.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF019	5120 bytes
SHA-256: `1f9e1356f5dd670cde8dc9ac8d86add0acecf3ab6b4b6d41d93aa339af58b9c1`

Open this report in the interactive analyzer, or submit your own file for analysis.