PDF malware analysis — malicious · 34f32b573c6b2e1b

MALICIOUS

PDF

65.4 KB Created: 2021-03-05 05:30:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23

MD5: d48d511f086226bcd330096ade06450e SHA-1: c60363bb3e546dff166bbe6d89511bfdc3c2bc13 SHA-256: 34f32b573c6b2e1b06b9726a2eea96ec2ef0736bd4da0b46f7efe2a10dfae968

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.7994

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://fokemale.ru/award?keyword=sas+enterprise+guide+7.15+download PDF link annotation
- https://cdn-cms.f-static.net/uploads/4411231/normal_6028235ee5ceb.pdfIn PDF document text
- https://cdn.sqhk.co/petebeki/Qeiejh6/35475983258.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4416938/normal_5ffeb7faa11c7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367624/normal_6022b4768218a.pdfIn PDF document text
- http://creditstar-kabinet.com/111291935332fpcy.pdfIn PDF document text
- http://mailedflkf.site/1928560754vl21b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367000/normal_60138ce62898e.pdfIn PDF document text
- https://cdn.sqhk.co/guwewaxa/ejYidUP/t-_mobile_ceo_email.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365525/normal_6035d6f821883.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4470679/normal_60027afc2cc07.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4465249/normal_6017de41c62ed.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426953/normal_600a67f5611f3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4458826/normal_5fe99fd4dcf67.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4488582/normal_5fe3dc440325b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4488581/normal_600c8f3cb4eae.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4451945/normal_6012aa89c1b0e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4367278/normal_5ff3e03e108b1.pdfIn PDF document text
- https://cdn.sqhk.co/kukisigafumi/Sbgi009/bombsquad_vr_1._4._136_apk_download.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393776/normal_5fd7b55dcf188.pdfIn PDF document text
- http://fitokaps.xyz/roxevanukibero66vs.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/87482b29-0233-48d3-9e80-0b8a5643c2fc/locate_missing_songs_itunes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e476afc8-4e89-44df-9def-5423c6fcfc31/adobe_premiere_pro_cc_color_presets_free_download.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e543.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE543	5612 bytes
SHA-256: `327ddce8c0c0a06b1aa949dcd5d64160d8b50ee0ad7b744c5e727e0e6881ca95`

Open this report in the interactive analyzer, or submit your own file for analysis.