Malicious PDF — malware analysis report

Static analysis result for SHA-256 2429ac901ca83722…

MALICIOUS

PDF

76.3 KB Created: 2021-03-16 07:21:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 60394bb3511e5cea33e11ea2866f8190 SHA-1: 31af471b4331f09f56246b6c020d6e0823e407fd SHA-256: 2429ac901ca83722959451da2611d4fc3ed227c3dec24b3ae9dcd22beb6781ef
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified by heuristics as potentially malicious and a phishing/trojan threat by ClamAV. The document body, though heavily obfuscated, contains keywords related to the URI, suggesting a lure. No scripts were extracted, but the presence of external URIs indicates an attempt to redirect the user to a malicious site, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8479

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=biomass+to+electrical+energy+conversion+pdf
    • https://cdn-cms.f-static.net/uploads/4393022/normal_6046e13f8a574.pdf
    • http://widonatozeg.mypressonline.com/notaxoka.pdf
    • https://static.s123-cdn-static.com/uploads/4468261/normal_5ff96909d8906.pdf
    • http://dontbeshy.xyz/16746556259ipjky.pdf
    • http://trendmobile.ru/264699452541c60f.pdf
    • https://cdn-cms.f-static.net/uploads/4480898/normal_602d752e9b4ad.pdf
    • https://cdn-cms.f-static.net/uploads/4420617/normal_60407a763ed64.pdf
    • http://ruluzuzadol.mypressonline.com/cell_phone_addiction_essay.pdf
    • https://static.s123-cdn-static.com/uploads/4372982/normal_60051e1029f0e.pdf
    • http://mon-cmb.best/lakozunizevupenumuvit9xrfv.pdf
    • http://fajujefa.getenjoyment.net/61400793204.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/mipizaju/narrative_writing_ideas_for_6th_grade.pdf
    • https://s3.amazonaws.com/divikufifir/nuvewivisoreranulez.pdf
    • https://uploads.strikinglycdn.com/files/c0cad376-13d7-41f3-9966-515898569980/fowabogurimiberenon.pdf
    • https://s3.amazonaws.com/nitirew/76979000792.pdf
    • https://s3.amazonaws.com/pojikovewijeja/do_filme_antes_de_partir.pdf
    • https://s3.amazonaws.com/voxulija/9106026620.pdf
    • https://uploads.strikinglycdn.com/files/fce8ef57-4334-4393-8bf4-7c2a9b2a77ed/what_does_annabel_lee_poem_mean.pdf
    • https://s3.amazonaws.com/lekelepowo/cisco_aci_simulator_ordering_guide.pdf
    • https://s3.amazonaws.com/sixenogafopoj/49346465704.pdf
    • https://s3.amazonaws.com/sowirutelevolur/tumerulifubewep.pdf
    • https://s3.amazonaws.com/mosezavor/both_either_neither_worksheet.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010cba.bin
8011e5fc651ad929cc19b213ec4bee453241b620f089a8ffdacfdc543e244122		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CBA 5476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.