PDF malware analysis — malicious · 2836202e36421d11

MALICIOUS

PDF

72.0 KB Created: 2021-03-12 03:50:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b9d9e1d56ab80568c8e2f3cb30e81254 SHA-1: 96fd47afaaf2d99db7ca65e9184b3d4d7d4111fe SHA-256: 2836202e36421d114282e44730fbf5cde28246e342cc9f5ac4379ad351c96228

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a URL that appears to be a lure for an award or scholarship. ClamAV and an ML classifier flagged this PDF as malicious, indicating it likely serves as a phishing or trojan delivery mechanism. The presence of an external URI suggests an attempt to redirect the user to a malicious site or download further payloads.

Machine Learning

Nyx PDF Classifier malicious score 0.9189

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://zajinet.ru/award?keyword=data+communication+and+networking+pdf+for+bca
- http://napowojeba.medianewsonline.com/silixugaxel.pdf
- http://zusagukitu.mywebcommunity.org/20170317795.pdf
- http://tiwujatujoput.mygamesonline.org/kuvaj.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://kitilogokufalu.atwebpages.com/dipig.pdf
- https://s3.amazonaws.com/vokeri/everfi_economics_module_1_answers.pdf
- https://uploads.strikinglycdn.com/files/cf08ca78-685b-4166-8245-783fc108d5f1/ferrari_812_superfast_engine_location.pdf
- https://uploads.strikinglycdn.com/files/1b4cf62c-631a-4ed9-ad32-ef49256dd413/pukepatujixoxunibu.pdf
- http://vemevusakeke.epizy.com/chinese_keyboard_app.pdf
- http://dusuvoparujizoj.rf.gd/nevada_cosmetology_law_test_study_guide.pdf
- https://s3.amazonaws.com/ragejufa/53322404851.pdf
- https://uploads.strikinglycdn.com/files/cb5aa965-ac38-46b9-8c87-484d9296cafb/zugupobapo.pdf
- https://uploads.strikinglycdn.com/files/023116d2-a438-4eff-89eb-e7e2cac7c7ee/como_saber_se_meu_relacionamento_chegou_ao_fim.pdf
- http://dapizodipe.myartsonline.com/are_electric_pole_saws_any_good.pdf
- http://sutexuvidag.myartsonline.com/zemop.pdf
- https://s3.amazonaws.com/befarekogol/self_coaching_101.pdf
- https://s3.amazonaws.com/potamotaz/eau_guidelines_penile_cancer.pdf
- https://uploads.strikinglycdn.com/files/2d504aec-3848-440a-a67e-54b825fb9c1f/6156019551.pdf
- https://uploads.strikinglycdn.com/files/7c812c2e-6162-4e6f-a7fa-c929c04bc745/streaming_nancy_drew_and_the_hidden_staircase.pdf
- https://uploads.strikinglycdn.com/files/b73fc341-0936-48d8-92e8-608d3189944f/que_significa_la_linea_del_destino_en_la_mano.pdf
- http://fepusum.onlinewebshop.net/is_it_better_to_breathe_out_of_nose_or_mouth.pdf
- https://uploads.strikinglycdn.com/files/0c06253c-ea41-425a-8eaa-7edfe13379eb/last.fm_scrobbler_not_working.pdf
- https://s3.amazonaws.com/zarevizebi/tewavepukotakajijibuxi.pdf
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.html
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e1f6.bin` `0eac1552a6a0cc8d6d43e14f5c157d052ff2bf21460314f67a2c213e0a454e63`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE1F6	6744 bytes
`font_01_sfnt_off0000f2dd.bin` `9ad36d2c764b7f5e6a08338a08dd6e9bb5fb02ccb23687f3d76d713748f40f49`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF2DD	5560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.