PDF malware analysis — malicious · 2f1165a9f6486740

MALICIOUS

PDF

76.3 KB Created: 2021-03-17 15:21:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8386f24f840ed601e3f1ad04f541089c SHA-1: 8cd4fcdce128930ca2b3d344c22a314d41f2088f SHA-256: 2f1165a9f6486740cb9c4ae1727b901f616c9fe4eced95cdbb4cc60c94d17868

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged the PDF as malicious. The document body, though heavily obfuscated, appears to be a lure for downloading Adobe Acrobat, which is a common tactic for phishing and malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.7744

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://midufefew.ru/award?keyword=adobe+acrobat+pdf+download+mac
- http://winoorama.space/black_hawk_down_book_amazonlr1kd.pdf
- http://znasila.ru/12503717712slu9.pdf
- http://qlemelest.online/tisugupuwufi1vvrz.pdf
- http://goromeo.club/dotadesevoxaruranit0o30r.pdf
- http://usesalon.xyz/what_does_a_court_of_contempt_mean_in_courtuleqd.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/df241bf9-1e5d-4fe2-a64d-acfab8782b33/lords_of_chaos_stream_netflix.pdf
- http://saripugoxek.rf.gd/badukopevivugo.pdf
- https://4f65501f-cdae-4966-b9db-49b15ad9d196.filesusr.com/ugd/52b593_7c8977b4d41c417c854da23710493ed8.pdf?index=true
- https://s3.amazonaws.com/fogibi/gutaz.pdf
- https://uploads.strikinglycdn.com/files/3f174fc4-0799-4e35-94ec-b19d3213a539/wufasakudawuzoj.pdf
- http://tutufot.rf.gd/129023356.pdf
- https://uploads.strikinglycdn.com/files/12a7bb30-174d-414c-aa18-1a94fbe099e9/gobutakalofafefunorenov.pdf
- http://rubuvajaroxe.epizy.com/97983724946.pdf
- https://uploads.strikinglycdn.com/files/93c19f27-6b5b-4f6e-a953-128deab15f1a/37094599601.pdf
- https://uploads.strikinglycdn.com/files/4a77e359-54fb-47b8-9b3e-0b7d599d9f40/22998667019.pdf
- https://662517ce-f374-4037-aebd-99b1dbe00103.filesusr.com/ugd/0c4177_02d10385b6ae416baf224d2e9d371853.pdf?index=true
- https://a8a2d6b8-6248-42a0-90a4-e25e421c2e59.filesusr.com/ugd/f63f29_fcc01d35b3474fd888ec83a922a794ef.pdf?index=true
- https://s3.amazonaws.com/gidibesuxi/fb_lite_versi_lama_apkpure.pdf
- https://a35aa970-3e4e-4c20-be1f-53d10001bce9.filesusr.com/ugd/af4e73_a642c19904624d9bafe2b4298c520f01.pdf?index=true
- https://s3.amazonaws.com/ginutu/14364672705.pdf
- http://rojinunapubepax.epizy.com/bassoon_sheet_music_harry_potter.pdf
- https://s3.amazonaws.com/mokamoba/37843868028.pdf
- https://uploads.strikinglycdn.com/files/f295a7d7-12ed-40e5-bd2a-2036098d15c9/percy_jackson_demigod_powers.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ee1a.bin` `4585fa8bd5857bdbf8a71dcb9a0db6523bb00e7ea9d7bd707feb0a1f12ab9983`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEE1A	5084 bytes
`font_01_sfnt_off0000ff57.bin` `b5b67bc690115fde4065cffdc4d965497bc9f2093ab20b6d1a097d2067533bd8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFF57	11908 bytes
`font_02_sfnt_off00012604.bin` `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12604	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.