Malicious PDF — malware analysis report

Static analysis result for SHA-256 38d243c549e43a8e…

MALICIOUS

PDF

60.2 KB Created: 2021-06-06 20:07:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 27205b9ccdb63045e18e87786dae2a7a SHA-1: d417bda7cc0fdacf3bbeb5b685f3c8d1038593d0 SHA-256: 38d243c549e43a8edc421f31892ef18c0601929fdfe702f1ea7c0f7b06178237
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by a machine learning classifier and ClamAV, which detected it as a phishing trojan. The embedded URL, disguised as a search result for 'Mahabharat serial star plus title song download', likely leads to a malicious payload. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest an attempt to redirect the user to a harmful resource, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9938

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/uplcv?utm_term=mahabharat+serial+star+plus+title+song+download
    • https://lawpropertyconsultants.co.uk/wp-content/plugins/super-forms/uploads/php/files/3j3rjvg381t346qukp5ib51ams/satosinetifavuge.pdf
    • https://autoschiller.de/wp-content/plugins/formcraft/file-upload/server/content/files/16075d8cc7153f---55852247516.pdf
    • http://geologicatoscana.eu/userfiles/files/14444763427.pdf
    • http://modelkyujin.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ee9e2cc9ef---92307268193.pdf
    • https://hsegroup.ru/wp-content/plugins/super-forms/uploads/php/files/99mjop9bkuuse1lhagirkqd2f4/21122654630.pdf
    • https://rockdental.co.uk/wp-content/plugins/super-forms/uploads/php/files/68cc86f74d43ee4408d75550a3dbf4e5/bufiturokunakadofojatexu.pdf
    • https://www.sahabatkeluargahomecare.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c82758b8f8---teladakowibilutoliv.pdf
    • http://afghansolar.com/userfiles/file/febapawedezibuk.pdf
    • http://cnex.cc/images/blog//file/41118623018.pdf
    • http://www.publicitymailing.ie/wp-content/plugins/formcraft/file-upload/server/content/files/16087842a350fb---zeliv.pdf
    • https://www.scilights.com/wp-content/plugins/super-forms/uploads/php/files/dab181491a5563bfdb7961aa56b58d02/5784443328.pdf
    • http://www.hptindia.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086a63c2dd13---90330346894.pdf
    • http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/160b9aca6e5035---76420170965.pdf
    • https://regalcabs.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160bb99c446a8f---64301887089.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cbc0.bin
14a81afa0c95e50440981f1e7bd5ce8a8d78304a12266732c37e54da0500bb5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCBC0 5460 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.