Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a74e7a6ec2432a0…

MALICIOUS

PDF

69.6 KB Created: 2020-11-13 08:09:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 07442babdd20604642e8e8a0359f6d1d SHA-1: cc3721a55ae348e048e68027e62fe803b8d017a1 SHA-256: 1a74e7a6ec2432a092004295a0909afaed2d6890a1086cf0021a5a2c3430e931
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. An external URI was found embedded in the document's metadata, pointing to a suspicious domain. While no scripts were explicitly extracted, the presence of an embedded URI suggests an attempt to redirect the user to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9234

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?utm_term=sikh+ardas+in+english+pdf
    • https://cdn-cms.f-static.net/uploads/4452171/normal_5fa977c53b107.pdf
    • https://cdn-cms.f-static.net/uploads/4455914/normal_5fabacb44c9ca.pdf
    • https://cdn-cms.f-static.net/uploads/4375503/normal_5fa763b801150.pdf
    • https://cdn-cms.f-static.net/uploads/4393362/normal_5f993c90e0798.pdf
    • https://cdn-cms.f-static.net/uploads/4367277/normal_5f8763eb62e10.pdf
    • https://cdn-cms.f-static.net/uploads/4370989/normal_5f8f91602720c.pdf
    • https://cdn-cms.f-static.net/uploads/4365621/normal_5fa6c3e8cd1bf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://s3.amazonaws.com/potofaw/at_home_jobs_dallas_tx.pdf
    • https://uploads.strikinglycdn.com/files/e43afd81-eb34-4153-85f7-a83cb1344035/tuvimelulazizowoma.pdf
    • https://uploads.strikinglycdn.com/files/bfd56ed9-161e-4853-84bd-e0178c660096/24329159773.pdf
    • https://uploads.strikinglycdn.com/files/22da0e46-9da0-4694-b43b-271d41cb45b1/lajevejo.pdf
    • https://s3.amazonaws.com/vezumobigodub/lutusekebitixuzifozexigum.pdf
    • https://s3.amazonaws.com/potevip/bloomington_high_school_north_football.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e97b.bin
13d6506df5efd94852304382de9786c7e122eda1e85ef119f9baa02331e1a32f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE97B 5068 bytes
font_01_sfnt_off0000fa99.bin
800aa3c24380a141756a30c1273c416a7c5f4327c4a33ebc08d3968b7c4265a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA99 2560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.