Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ddb92ee0c1d5c01…

MALICIOUS

PDF

76.3 KB Created: 2021-03-09 02:28:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b0bf0ed92a68426974d5c4615baa8e58 SHA-1: 8e56f5ae86a953a70071a4d1b49048343d12e5a3 SHA-256: 1ddb92ee0c1d5c01a8758b3ca750acea5b3fd309bfc1bae136fa2e75da11195f
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as 'Pdf.Phishing.Trojan'. It contains an embedded URI pointing to a URL that masquerades as a PDF download for interview questions, likely a lure to trick users into downloading a malicious payload. No scripts were extracted, but the overall structure and detection indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6626

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=solution+architect+interview+questions+and+answers+pdf
    • https://cdn-cms.f-static.net/uploads/4372101/normal_600b724fcf118.pdf
    • https://cdn.sqhk.co/vorowobenune/Hhghcjd/mack_upfitters_guide.pdf
    • https://cdn.sqhk.co/bigulikexupa/ieNIwxC/86043918949.pdf
    • https://cdn.sqhk.co/kuzetuzame/MjKieyn/alien_invaders_game_free_download.pdf
    • https://static.s123-cdn-static.com/uploads/4404121/normal_5fc800ebd2ca9.pdf
    • http://gitikirazidapi.medianewsonline.com/asko_f12_error_dishwasher.pdf
    • http://xuxetosufuzo.getenjoyment.net/the_boy_in_the_striped_pyjamas_full_movie_in_hindi_download.pdf
    • https://static.s123-cdn-static.com/uploads/4367311/normal_5fcd5135340fb.pdf
    • http://fijexojor.getenjoyment.net/geronimo_stilton_books_list_with_pictures.pdf
    • http://luwogexejel.getenjoyment.net/ronotudapigupararom.pdf
    • https://cdn.sqhk.co/sivumazudi/bA2d1gd/3d_pinball_space_cadet_online_jugar.pdf
    • https://cdn-cms.f-static.net/uploads/4449622/normal_6032f41f52ca4.pdf
    • http://kemytbok.xyz/how_to_draw_a_turkey_using_hand45ofe.pdf
    • https://cdn.sqhk.co/wifurovud/ZR7gCji/petroleum_engineering_colleges_in_new_york.pdf
    • http://nextauto02.ru/advanced_placement_literature_teaching_unit_practice_multiple_choice_questionsugchm.pdf
    • http://rekugegik.scienceontheweb.net/86940983728.pdf
    • http://itrom.fun/uc_browser_mini_app_javav8zaq.pdf
    • https://static.s123-cdn-static.com/uploads/4495392/normal_5ff78c6103a3c.pdf
    • http://supermagazforsale1.xyz/lijutuzuraniraxagokops8ecx.pdf
    • http://alania365.ru/72782299312tnqxv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8230b64c-6adf-468e-b669-3eb68cae8123/kevebolira.pdf
    • https://s3.amazonaws.com/woxojuxafopuv/alcova_lake_weather_report.pdf
    • https://s3.amazonaws.com/jazuravazaguz/jelulevotubolofiraxojodab.pdf
    • https://s3.amazonaws.com/zowibatev/green_cheek_conure_care_guide.pdf
    • https://uploads.strikinglycdn.com/files/6cf62b1f-b580-4cf0-94e0-d81034f10831/datupu.pdf
    • https://s3.amazonaws.com/kefodek/accessing_icloud_photos_from_android.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011380.bin
533e31033f721ad8a6277b78843c5e2892df16ffe6ee9d4428927eef447f6bb8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11380 5624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.