PDF malware analysis — malicious · 28a093a6b076b150

MALICIOUS

PDF

58.8 KB Created: 2021-05-30 23:48:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7e3324155ebd8d7150ba054a15c59c6c SHA-1: 9726732126d39234bf5f57771ba39a6e1ae84136 SHA-256: 28a093a6b076b1506c2269fc857e02628477a94fb0d61924fdc43760f4c0d825

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by multiple engines, including ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains embedded URLs that likely lead to phishing or malware distribution sites. Although no scripts were explicitly extracted, the PDF structure and embedded URIs suggest it's designed to trick users into navigating to malicious content, potentially for phishing or further payload delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9595

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.urbanwaterways.info/files/6955353351.pdf
- http://philippinesroadshow.com/wp-content/plugins/super-forms/uploads/php/files/95b16970e1d71714b02c601f1a153951/84189943901.pdf
- http://bhs-class1957.com/clients/35434/File/bulalujosanufifumabugawa.pdf
- http://www.predoisiasociatii.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160831d395710a---6252595990.pdf
- https://www.servicioscalibrados.com/wp-content/plugins/super-forms/uploads/php/files/d198b6ba562b36b0b4309863aa578020/14740058541.pdf
- http://www.mvdisposal.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075eabe471b9---44806992928.pdf
- http://www.acefence.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079216f68d8b---71545225567.pdf
- http://thm-holding.ru/wp-content/plugins/super-forms/uploads/php/files/6d2d980b4ce6c50e4511ed9a2250d60f/gijopezoxipumuxide.pdf
- http://stylist.in.ua/wp-content/plugins/formcraft/file-upload/server/content/files/1607eeae90cd7b---42846946710.pdf
- http://rymwid-training.com/userfiles/file/tegimuxejixodele.pdf
- https://stagerightstaging.com/wp-content/plugins/super-forms/uploads/php/files/af97476030cbaca8bf92c625fda352f9/dixituniwuja.pdf
- http://www.dnevi-sekretarjev.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160943a61ac8a6---65897174139.pdf
- https://zanhotel.ro/beficientconsultingFiles/file/62406898530.pdf
- https://www.heainc.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f004413487---67823257483.pdf
- http://indel.sk/userfiles/file/ferodojutunegukegiji.pdf
- http://2girlstrippin.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072f2a8a6a0b---lumazafuburuxeniraxukume.pdf
- http://andreagarciam.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609445a693d78---75613825088.pdf
- http://antik-cafe-bergen.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608b276b2fcaa---1669435211.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://feedproxy.google.com/~r/Uplcv/~3/1KS0DP0cxss/uplcv?utm_term=procedimiento+de+exanguinotransfusi%25C3%25B3n+pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cf5d.bin` `4b97010ce095865992b9f02fc2489da54b8c5146c4219df3f291bbd5e7e2d234`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCF5D	5648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.