PDF malware analysis — malicious · 337b8f7313f07f49

MALICIOUS

PDF

67.6 KB Created: 2021-01-23 14:41:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 2b2cf8fb76faa70b4c892b2694e02d49 SHA-1: ea4c211b583820f4b2c7abfba64cd0634462ec3f SHA-256: 337b8f7313f07f49db4b02faa846bd9ef0c02be8459ca444e0f23f8276142c3b

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains an embedded URL pointing to a site offering a 'binary options prediction indicator free', which is a common lure for financial scams. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9705

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/aws?utm_term=binary+options+prediction+indicator+free
- https://cdn-cms.f-static.net/uploads/4403822/normal_5fd8b34a1d93c.pdf
- https://static.s123-cdn-static.com/uploads/4402262/normal_5ff80577dc07d.pdf
- https://site-1168264.mozfiles.com/files/1168264/shelter_free_movie_online.pdf
- https://static.s123-cdn-static.com/uploads/4402289/normal_5ff10e070bbbf.pdf
- https://cdn-cms.f-static.net/uploads/4404313/normal_5fd6759ab9c17.pdf
- https://site-1179337.mozfiles.com/files/1179337/best_voice_recorder_app_iphone_free.pdf
- https://site-1177386.mozfiles.com/files/1177386/oye_como_va_percussion_ensemble.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/kikunojulejuj/25136075534.pdf
- https://s3.amazonaws.com/savifin/22513975311.pdf
- https://s3.amazonaws.com/fatikonavori/after_effects_text_animation_templates.pdf
- https://s3.amazonaws.com/jepinebawo/78193106992.pdf
- https://s3.amazonaws.com/xamibebulosaxug/pagakasaf.pdf
- https://s3.amazonaws.com/fifomi/niveroneneto.pdf
- https://s3.amazonaws.com/zodererezuzuxi/hole_cutting_tools_sheet_metal.pdf
- https://s3.amazonaws.com/gupawupigawono/headway_intermediate_fourth_edition_workbook_answers.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fa17.bin` `8d9a6c1059d9f5c1e87ea2b069eb7de1489877805f77ad800c7c1245623140a9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFA17	5268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.