Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a8e92debe52ea15…

MALICIOUS

PDF

79.1 KB Created: 2021-03-27 12:36:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 930124b081e6a300c513ec9987c0560d SHA-1: e33132a8fec3da2c79215a89bedadba1e8a6d82d SHA-256: 2a8e92debe52ea15b25781f4deae02ff26304cbc013b812bab0fb4fb706796d9
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain. ClamAV and ML heuristics flagged the file as malicious, specifically identifying it as a phishing trojan. The document body, though partially corrupted, suggests a lure related to an 'award', aligning with common phishing tactics. No scripts were extracted, but the presence of an external URI is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6573

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=antigeno+anticuerpo+pdf
    • https://lavuzolitad.weebly.com/uploads/1/3/4/3/134327879/demesuzusodepufixu.pdf
    • http://erkutungotu.com/canadian_citizenship_test_questions_2020iubi4.pdf
    • http://1-bog.ru/narawowabonovunudoniyrt65.pdf
    • http://zukoretevir.medianewsonline.com/cause_effect_essay_structure.pdf
    • http://zuwifipenabed.medianewsonline.com/jutugidite.pdf
    • https://cdn.sqhk.co/bitubebo/RFN18M3/mexanojugok.pdf
    • http://tixshopclub.space/butewosomubijuzzq1a7.pdf
    • http://pravagims.net/el_abc_del_liderazgo_john_maxwell_pdo74qc.pdf
    • https://kazazurijufom.weebly.com/uploads/1/3/0/8/130814205/5e110.pdf
    • https://cdn.sqhk.co/rujiwujik/idGYqN0/survivor_tv_show_casting_call.pdf
    • http://lalikexitaxixix.getenjoyment.net/pomabevunesewiketunesipa.pdf
    • http://zugobopepoj.sportsontheweb.net/confidence_power_plus_treadmill_pink.pdf
    • http://pc-remont.website/is_social_security_payments_going_up_in_202035z6q.pdf
    • http://paganel.world/download_aplikasi_rec_screen_recorderygsfv.pdf
    • https://cdn.sqhk.co/timafewa/jciguq2/76242764689.pdf
    • http://znatural.space/66784692957nx4n0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jadudusujuje/14838890405.pdf
    • https://s3.amazonaws.com/napoledunadigo/python_bool_string_format.pdf
    • http://guseboses.atwebpages.com/archaeology_essentials_4th_edition_free.pdf
    • https://s3.amazonaws.com/jotizifime/what_does_the_child_say_in_mandalorian.pdf
    • https://s3.amazonaws.com/tawosutosuxi/1695301388.pdf
    • https://s3.amazonaws.com/vufuzewasi/13502211152.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f486.bin
5aa527b9d5650b227d9859bff0c2f986103a7275d18f71682eb717428f4fa01f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF486 5100 bytes
font_01_sfnt_off000105fb.bin
3d57e8849e3d752e77243192f0f0b9ea07f6796e78de25db642557d47867477b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105FB 12116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.