Malicious PDF — malware analysis report

Static analysis result for SHA-256 1878d332347a61b3…

MALICIOUS

PDF

84.6 KB Created: 2021-03-27 22:28:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4720ffa6422e80da508e3d7a4958af40 SHA-1: d8190458d9998f8564c7c5135a05c6f81c1cc7a4 SHA-256: 1878d332347a61b334fbd57be5b0af2b59f3349a605b584a1733a5bd3c0e4964
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that leads to a phishing site, as indicated by ClamAV and ML classifier detections. The document body, though heavily obfuscated, suggests a lure related to a product review, likely to trick users into clicking the malicious link. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly suggest a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7608

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/aws?utm_term=delta+table+saw+36-725+review
    • https://pisixaxonazav.weebly.com/uploads/1/3/5/3/135394173/2583299.pdf
    • http://sdl-trade.com/kumijosesumeriwese5abtf.pdf
    • http://x-bionic.shop/is_it_healthy_to_eat_dinner_earlymn2b6.pdf
    • https://cdn-cms.f-static.net/uploads/4445736/normal_6025f22fa7c39.pdf
    • http://lnstagram-verifedbadge.com/how_to_use_a_keurig_mini_youtube93k2z.pdf
    • https://sekikeke.weebly.com/uploads/1/3/4/7/134739811/nuromenodijunizevi.pdf
    • https://static.s123-cdn-static.com/uploads/4487916/normal_600495bfa86fe.pdf
    • https://vuxupiwiruxip.weebly.com/uploads/1/3/0/9/130969000/pukobejexi.pdf
    • https://cdn-cms.f-static.net/uploads/4485010/normal_600f8ca5a00ab.pdf
    • http://juilopkiretlo.ru/ashland_or_weather_reportmo6y5.pdf
    • https://pixasowurixes.weebly.com/uploads/1/3/4/9/134904492/7237e407421b.pdf
    • http://idealicaitaly-ufficiale.site/categorical_versus_numerical_datawrec8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/badodemebo/32233331663.pdf
    • https://s3.amazonaws.com/nowokil/mabibisejefi.pdf
    • https://uploads.strikinglycdn.com/files/b1b5761c-470e-4d6d-9655-e672b79e9a3f/yard_machine_snow_blower_4.5_hp_21.pdf
    • https://b5f169ef-6bcf-4d19-a24b-32bdc9dd7a5f.filesusr.com/ugd/2e79a6_44e23565a9bd4f76962df9eda37811ae.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e6f88315-5751-4501-a604-25ee2e110270/how_to_use_log_table_in_hindi.pdf
    • https://s3.amazonaws.com/fobupojowojon/nitecore_d2_intelligent.pdf
    • https://uploads.strikinglycdn.com/files/6324e765-8803-46bb-983f-9fa12e25b69a/how_to_add_buttons_to_header_wix.pdf
    • https://50bf384a-eeac-4f26-a262-e2ba1a5e00ba.filesusr.com/ugd/17159d_061982bbefea4882891cad746ce066fb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3c591ff8-ccc1-40b0-88da-e96dd3187e0e/criminal_defense_attorneys_in_houston_texas.pdf
    • https://s3.amazonaws.com/wizomoravazub/agriculture_website_templates_free_psd.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013f5b.bin
eb2839dbc4a2397681e06167caa7419485bded881e4386d5999c7ec310fc31a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F5B 5228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.