Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a3341cc1922d572…

MALICIOUS

PDF

76.3 KB Created: 2021-03-03 01:45:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: ce8b9c63a0b063fe5e0b5a1b7871238d SHA-1: 771304efdf78097d3ab526b088c3fbaa55464e69 SHA-256: 1a3341cc1922d57272230faf71156c58dc57eeb6c850959d03501baf5fce8c3c
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that leads to a domain associated with phishing. The document body, though heavily obfuscated, contains keywords related to the URL, suggesting a lure to trick users into visiting the malicious link. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9215

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=pret+chai+latte+with+oat+milk+calories PDF link annotation
    • https://cdn.sqhk.co/moxoxitij/RQicMij/wutipefoj.pdfIn PDF document text
    • https://cdn.sqhk.co/dudugetogi/cgcIieK/sofusowebisadagem.pdfIn PDF document text
    • https://cdn.sqhk.co/lididiregi/cjgc1jd/age_of_empires_2_taunts_soundboard.pdfIn PDF document text
    • https://cdn.sqhk.co/mawejoxejobe/jcjgjan/real_glitter_live_wallpaper_iphone.pdfIn PDF document text
    • https://cdn.sqhk.co/datolabevev/ihjfeic/twitter_search_date_until.pdfIn PDF document text
    • https://cdn.sqhk.co/fifenije/egf2cgj/shogun_restaurant_san_diego_california.pdfIn PDF document text
    • https://cdn.sqhk.co/teketerep/dhe6id6/t-_mobile_ceo_mike_sievert_email.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fakuguvil/android_pie_target_sdk_version.pdfIn PDF document text
    • https://s3.amazonaws.com/gofiguj/pusivid.pdfIn PDF document text
    • https://s3.amazonaws.com/tikofaketonub/blade_and_soul_launcher_2.pdfIn PDF document text
    • https://s3.amazonaws.com/faduxodiwo/nevufevoturokozudirifuso.pdfIn PDF document text
    • https://s3.amazonaws.com/bopuxosavubare/71898243350.pdfIn PDF document text
    • https://s3.amazonaws.com/vufupu/fipenurepaxiluvu.pdfIn PDF document text
    • https://s3.amazonaws.com/sikuva/75957294769.pdfIn PDF document text
    • https://s3.amazonaws.com/pasawexawinogad/how_to_breathe_while_strength_training.pdfIn PDF document text
    • https://s3.amazonaws.com/bevekizadoxuj/89489039562.pdfIn PDF document text
    • https://s3.amazonaws.com/wejuvono/real_estate_closing_statement_excel_template.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f503.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF503 4880 bytes
SHA-256: dd8d893074aba2584d73ea434c9852e8152f8beb8d2924eac353b61c7ab13037
font_01_sfnt_off0001059c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1059C 10840 bytes
SHA-256: 58a9b8af6c30d82bb56119d5d1ad9e5002d4ebac35659436779914ab11544017

Open this report in the interactive analyzer, or submit your own file for analysis.