Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e923907d46083fc…

MALICIOUS

PDF

120.6 KB Created: 2021-03-17 17:17:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 357d38f0202acfcf7c72c6c4f2c9ee2a SHA-1: 881b5233a1817fa66f576c9f93de2eec16c86916 SHA-256: 2e923907d46083fcdff33edd4f74897cdcd5275f45966166a1d401d096909375
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV with a 'Pdf.Phishing.Trojan' signature. It contains an embedded URI pointing to a suspicious domain, likely intended to host a phishing page or download further malware. The document body, though heavily obfuscated, contains text related to 'Durga suktam telugu pdf' and the wkhtmltopdf application, suggesting a lure to disguise the malicious intent. No scripts were extracted, but the presence of external URIs and the ClamAV detection strongly indicate a phishing or trojan delivery attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.0978

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/strik?utm_term=durga+suktam+telugu+pdf
    • http://sanatoriy-izumrudny.ru/69396569780wlhax.pdf
    • https://cdn.sqhk.co/fizuborugas/jjbjdBO/74280153900.pdf
    • https://cdn.sqhk.co/wevujawej/msiaBia/administrators_report_to_creditors.pdf
    • http://zatoxuvisovapuf.sportsontheweb.net/printable_height_conversion_chart_feet_to_inches.pdf
    • https://cdn.sqhk.co/neratimo/haMiieC/call_of_duty_modern_warzone.pdf
    • http://hookup157.fun/16326621132ibrwf.pdf
    • https://cdn.sqhk.co/bulelovuroga/jkhiggE/38156570203.pdf
    • https://cdn.sqhk.co/tipefima/dEkjiKg/unnatural_selection_muse_meaning.pdf
    • http://kumululurug.scienceontheweb.net/pafor.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://scripts.sil.orgThis
    • https://s3.amazonaws.com/tamovagag/futanamobuket.pdf
    • https://uploads.strikinglycdn.com/files/54451963-9984-4dd8-9226-1942e98251b5/what_is_ex_oriente_lux_meaning.pdf
    • https://s3.amazonaws.com/bejexe/jepezigula.pdf
    • http://futebowa.atwebpages.com/prentice_hall_algebra_2_workbook_answer_key.pdf
    • https://8eb0ff2f-1b5f-41fb-a82b-bf279dc7f43e.filesusr.com/ugd/868f76_02a3537db98a43489d09154354d11319.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c924543d-91d8-482b-9998-05868bf64c54/78171913080.pdf
    • http://vekamodadon.onlinewebshop.net/candidate_elimination_algorithm.pdf
    • https://uploads.strikinglycdn.com/files/764274b0-7d89-4dcd-84de-396f983be73e/what_would_make_a_dryer_not_turn_on.pdf
    • https://uploads.strikinglycdn.com/files/8a9d44d6-f7ef-4aef-a800-792104900828/29645019498.pdf
    • https://c8019651-2137-4367-b38e-775fff3f8a75.filesusr.com/ugd/fc5a02_b029a66d937444dfa7aad954332a6fc6.pdf?index=true
    • http://pimimozoji.myartsonline.com/wazepesaf.pdf
    • https://s3.amazonaws.com/leributafa/98957056060.pdf
    • https://uploads.strikinglycdn.com/files/87a485e2-a692-4bcb-8896-b458b1da4f58/schlage_digital_lock_s510_review.pdf
    • https://c1d61d78-9bae-425c-b347-ee91470fe4f1.filesusr.com/ugd/60933b_277ad768b2404074831aef6fc4480db1.pdf?index=true
    • https://s3.amazonaws.com/padosumifubobo/california_mathematics_grade_7.pdf
    • http://scripts.sil.org/OFL
    • http://scripts.sil.org/
    • http://scripts.sil.org/OFLAbyssinica

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a1e.bin
2aa187043f72194f1ef653698a44ff36a69cee39d06623d34f3508b5cadc2f78		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A1E 5044 bytes
font_01_sfnt_off00011b52.bin
fd0baac36cf8fc893687cbe6b3b8165417b6c4fca046c9a5e64821bfdf5295b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B52 2140 bytes
font_02_sfnt_off000124c5.bin
ac25617aaa4f00aac1b9f66e9cca41c0d93b041b27d0573be0bb0a796fdfd40f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x124C5 29308 bytes
font_03_sfnt_off000156de.bin
3e70f6b96f37055faaa3bb40e7d365e7a5b3dc8a8ea290070cbd86d49dd3214b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x156DE 11360 bytes
font_04_sfnt_off00017dff.bin
1d8423421361c8033028cc9c1a25d4171c4edd11138eb9dbd3203d0db4f59244		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17DFF 41336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.