PDF malware analysis — malicious · 1e214191df1ed87d

MALICIOUS

PDF

63.9 KB Created: 2021-06-02 07:09:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 978db1866d07af9a22e699c6f4eaf38d SHA-1: f839ddd52bc3041d65457c8b57f6572aaa685ca2 SHA-256: 1e214191df1ed87d9a171fac10d73db71e4b16fdf44509abda0f8a0a50135a1b

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a heuristic indicating an external URI. The embedded URL points to a suspicious domain, suggesting a phishing or scam attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URI are strong indicators of malicious intent, likely related to social engineering to trick users into visiting a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.8253

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://smidgel.ru/pbw?utm_term=the+story+of+platinum+ielts+reading+answers+pdf
- https://static.s123-cdn-static.com/uploads/4470402/normal_600633c37bb85.pdf
- https://cdn-cms.f-static.net/uploads/4390057/normal_603765b9c3d9c.pdf
- https://static.s123-cdn-static.com/uploads/4375886/normal_5fc7e8750b6a0.pdf
- https://cdn-cms.f-static.net/uploads/4379852/normal_602c61c1060c1.pdf
- https://static.s123-cdn-static.com/uploads/4380527/normal_5feb2702802cc.pdf
- https://cdn-cms.f-static.net/uploads/4366982/normal_5fe85fd2ba1a9.pdf
- https://static.s123-cdn-static.com/uploads/4452587/normal_5fcbae9a70f59.pdf
- https://cdn-cms.f-static.net/uploads/4472186/normal_601b53618c23c.pdf
- https://cdn-cms.f-static.net/uploads/4382949/normal_601baf7236460.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/4a4612d3-242b-41cc-8c1b-95de313dc2fe/42126380916.pdf
- http://poforezufovu.pbworks.com/f/58604825447.pdf
- https://uploads.strikinglycdn.com/files/c735f3f6-0555-4583-9790-872bd2108f13/87413443853.pdf
- https://uploads.strikinglycdn.com/files/9b62e32f-773c-4bf6-b55c-772ad592c182/16813665558.pdf
- https://uploads.strikinglycdn.com/files/039f74f8-5b7f-44aa-994e-59e9495160e5/el_uno_es_un_palito_en_forma_de_baston.pdf
- https://uploads.strikinglycdn.com/files/fdfebac9-f2eb-4a0a-820d-2523a9083742/88263410366.pdf
- http://visetululiv.pbworks.com/f/conventional_non_occupant_co_borrower_guidelines.pdf
- https://uploads.strikinglycdn.com/files/9ec19191-8395-4c9c-a748-fc20b9419c60/durixagivi.pdf
- https://uploads.strikinglycdn.com/files/7a65260d-3bf7-45c4-ada3-51ce26806bce/6093624803.pdf
- https://uploads.strikinglycdn.com/files/56a703cf-76ad-4d2f-8a43-b80d11942c20/cooks_essential_pressure_cooker_brown_rice.pdf
- https://uploads.strikinglycdn.com/files/6dd9fa33-c312-4fed-9edf-381ad391564b/the_valley_of_horses_audiobook.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ef11.bin` `5baba51f8af57cf50dce8c83425cc731ac20f2adca5946cc03626899f70acd8f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEF11	5600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.