Malicious PDF — malware analysis report

Static analysis result for SHA-256 237bb36d9ee42c62…

MALICIOUS

PDF

77.7 KB Created: 2021-03-19 19:15:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1586563f07e79bb60ff8386693ddcd98 SHA-1: 31bb7f42044364ef771e3532af7f768ba80e931c SHA-256: 237bb36d9ee42c62893a508c0ae48212bd9d168d8817ae7ef8afaa519a90680b
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, which is a strong indicator of a phishing or malware distribution attempt. The ML classifier and ClamAV detection further support its malicious nature. The document body, though heavily obfuscated, suggests a lure related to 'sejarah karate di indonesia pdf'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7941

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=sejarah+karate+di+indonesia+pdf
    • https://cdn-cms.f-static.net/uploads/4444092/normal_603874ef0fa2c.pdf
    • http://rapisakaxo.66ghz.com/testing_speaking_skills.pdf
    • http://rorixuge.iblogger.org/72051319867.pdf
    • https://cdn-cms.f-static.net/uploads/4383470/normal_601442cd7c1ec.pdf
    • https://cdn-cms.f-static.net/uploads/4413980/normal_601ebc42dfdbd.pdf
    • http://zinuvudoliku.iblogger.org/arbily_tws_i7_manuale_italiano.pdf
    • http://figuxovutofid.mygamesonline.org/fanumafoxebife.pdf
    • http://xabudumame.mypressonline.com/neufert_anthropometry.pdf
    • https://static.s123-cdn-static.com/uploads/4495399/normal_5feb6869cd3ed.pdf
    • http://lidedapomegila.iblogger.org/45700406874.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://femejedad.epizy.com/subarigabosir.pdf
    • http://jugututinotu.rf.gd/xafukuganatuxuvefusoletew.pdf
    • https://uploads.strikinglycdn.com/files/7f9cefcb-ff90-4d07-8bc3-b8acb5da0588/75037410241.pdf
    • https://uploads.strikinglycdn.com/files/8a077311-e036-4c5f-92c8-59ddf650e48a/wd_my_cloud_software_download_windows_7.pdf
    • https://s3.amazonaws.com/woxotopapozokev/40959975810.pdf
    • https://uploads.strikinglycdn.com/files/d3ecaf15-eadf-40f1-8e22-e99aa596898c/best_build_for_solo_play_eso.pdf
    • https://uploads.strikinglycdn.com/files/02851647-ef7c-41c8-9426-188dd90ee690/netgear_wndr3700_repeater.pdf
    • https://s3.amazonaws.com/miledu/66809032574.pdf
    • https://uploads.strikinglycdn.com/files/c71fe857-c612-4236-b038-dbea4509dfc1/vst_roland_xp_80_download_free.pdf
    • http://gurumuniz.rf.gd/el_principito_en_frances_audiolibro.pdf
    • http://sosefamip.epizy.com/how_to_draw_a_dog_body_for_beginners.pdf
    • http://juvemekexiki.rf.gd/68997864511.pdf
    • https://s3.amazonaws.com/zesixefe/actor_atharva_photo.pdf
    • http://kukokiw.rf.gd/cadena_perpetua_en_colombia.pdf
    • http://futebowa.atwebpages.com/derivative_rules_and_formulas.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000113bf.bin
0e66f008b38a078c3d11dec93a666ee307b7504caf6dcc42cdc0c43d683d2c6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x113BF 5340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.