Malicious PDF — malware analysis report

Static analysis result for SHA-256 302d09be108054d7…

MALICIOUS

PDF

67.6 KB Created: 2021-02-08 06:28:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 0a88fea3cb75c657bea839ccd6256a90 SHA-1: 9c8d9e3a3a4aac7bfce63f3a254defc1694e606b SHA-256: 302d09be108054d7da1f56375d6ed57b9e0f0f5ceb1157fc7aee28d772766a6b
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, and ClamAV detected it as a phishing trojan. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it might be a generated document. The presence of multiple unknown URLs further supports a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9471

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/aws?utm_term=stranded+deep+mod+apk PDF link annotation
    • https://cdn.sqhk.co/timadupak/JzhdjiS/62939073639.pdfIn PDF document text
    • http://greatholl.com/8525423158769gb2.pdfIn PDF document text
    • https://cdn.sqhk.co/zubavagi/RXjajcq/sad_anime_girl_image_hd.pdfIn PDF document text
    • http://allrecipes.pro/19443090975n45ty.pdfIn PDF document text
    • http://interior.estate/figure_drawing_book_downloadvlts7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376374/normal_601217592f7ce.pdfIn PDF document text
    • https://cdn.sqhk.co/vozevadijut/icYgd4w/3035416232.pdfIn PDF document text
    • http://mujuwowewo.22web.org/examiners_report_2017_ocr_chemistry.pdfIn PDF document text
    • https://cdn.sqhk.co/kurafuso/jjggfHV/73858524276.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469643/normal_5fd7d8aa2c55c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gupojakami/coast_guard_marching_song_sheet_music.pdfIn PDF document text
    • https://s3.amazonaws.com/nitajosasa/suveputefe.pdfIn PDF document text
    • https://s3.amazonaws.com/rerinago/57422053193.pdfIn PDF document text
    • https://s3.amazonaws.com/gimisorixosu/romudaxuwijavarekina.pdfIn PDF document text
    • https://s3.amazonaws.com/gumagabu/bloodstained_quest_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/xesigeze/48316038599.pdfIn PDF document text
    • https://s3.amazonaws.com/nawosineromigi/calculator_free_for_android_mobile.pdfIn PDF document text
    • http://delonewafunedi.rf.gd/all_video_converter_apk_free.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e158.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE158 7000 bytes
SHA-256: 12412131a711a2900bed65afcd80894c88c29946b6baf6ba1cb4b1208abc6791
font_01_sfnt_off0000f915.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF915 5064 bytes
SHA-256: ce66f3e929cd916e0915686fa1bb538e7e1e70e200bad00e0631fb5d58c2fee0

Open this report in the interactive analyzer, or submit your own file for analysis.