Malicious PDF — malware analysis report

Static analysis result for SHA-256 39b113ee93803f1e…

MALICIOUS

PDF

137.5 KB Created: 2021-05-07 21:32:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3fb86802211c5eba3566e72e8ab4d8b9 SHA-1: 58f01e6468fb53ed646232e45ec853df7fa45074 SHA-256: 39b113ee93803f1e9cf4830075d6eb15901a704684e1bbec723254b8ccf0c086
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains embedded URLs that point to potentially malicious content, suggesting it is used as a lure to redirect users to harmful sites. No scripts were extracted, but the presence of multiple suspicious URLs indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9719

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cb2b77ee54---52080056637.pdf
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608db6677f141---piselidinubunokesanageve.pdf
    • https://fiambreszav.com/wp-content/plugins/super-forms/uploads/php/files/e88cda745a7eb301a8368219166c97f1/zigidiguxudazotuforagiw.pdf
    • https://avenirpourtous.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160862e6867648---18033986030.pdf
    • http://aivieksteslaivas.lv/userfiles/file/lesegimefuve.pdf
    • https://diversified-nj.com/wp-content/plugins/super-forms/uploads/php/files/7ba1e7312891d4207eb9a73f75c2b994/70970633544.pdf
    • https://regalcabs.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16071a653a9cdb---xanebofolelazowos.pdf
    • https://laser-arena.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1608383840bcec---mituxizusunug.pdf
    • http://www.belladermeestetica.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160761bfb94fef---20850149136.pdf
    • https://www.rowtheerne.com/wp-content/plugins/super-forms/uploads/php/files/b9b9cffd4d6386921a1be491f839eef3/xijotejonimiworomuzusivif.pdf
    • https://ludifrance.fr/userfiles/file/36625378875.pdf
    • https://dipinkrishna.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075c46e1be76---rotewekazojaz.pdf
    • https://trsbarriersdirect.com/wp-content/plugins/super-forms/uploads/php/files/ljbht0er92o3l3q45rmmo6387f/93205550315.pdf
    • http://anhbanglaw.com/userfiles/file/69219021165.pdf
    • https://www.m2asolutions.com/wp-content/plugins/super-forms/uploads/php/files/21ba04d89b16dcc1b951fb2533c578a5/33482386128.pdf
    • https://fobiy.net/wp-content/plugins/super-forms/uploads/php/files/7ff4699985c93baed2ebd00199eb92e1/rikudejadaw.pdf
    • http://drinkandshrink.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1607d158d6820a---22731881321.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BvfzZFkJO3s/uplcv?utm_term=bovine+spongiform+encephalopathy+causes
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00020c5a.bin
5c88696335258a5fb5828806dc5d96fa0aadfa47b649b196c6f4daff5f9ce236		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20C5A 5640 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.