Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d9c2220f3dbffd0…

MALICIOUS

PDF

240.4 KB Created: 2020-04-17 07:23:52 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 447cacef8f655455774616a228843d4a SHA-1: 5bad09c00db04c7162707c471f522fe572c6d2cc SHA-256: 3d9c2220f3dbffd0347feae55fc00e6c39dce5fd0e63392d29ba6ca64c5baba0
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains an embedded URL that redirects to a page with a similar name to the document title, likely a social engineering lure. The ClamAV heuristic confirms this file is malicious. The presence of multiple similar URLs suggests a pattern of hosting malicious content on compromised or attacker-controlled domains.

Heuristics 3

  • ClamAV: Pdf.Malware.Agent-9902546-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Malware.Agent-9902546-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://block1949-asu.com/uploads/1/3/1/1/131164269/131164269.html#sorcerer+warlock+multiclass+guide
    • http://dandehunter.com/uploads/1/3/1/3/131383427/8694601.pdf
    • http://noramanca.com/uploads/1/3/1/3/131380687/netawapamadi.pdf
    • http://2footfrenzy.com/uploads/1/3/1/3/131380836/tamewa_pikuguwif_jorotanesogufok.pdf
    • http://funnysquirrelshirts.com/uploads/1/3/0/2/130274301/34e298b5b916b2.pdf
    • http://eatablekc.com/uploads/1/3/0/9/130969260/kaguw-kexezemefeb.pdf
    • http://livredesoi.com/uploads/1/3/0/8/130873902/timanetidipo.pdf
    • http://behfurnishings.com/uploads/1/3/0/7/130739430/ritikolemonokatevaz.pdf
    • http://platinumclothing.net/uploads/1/3/1/0/131070001/1490479.pdf
    • http://supportappsummary2932988ambewelicblpp.org/uploads/1/3/0/3/130323641/rarimu.pdf
    • http://claudiawrightson.com/uploads/1/3/0/7/130775203/8202765.pdf
    • http://stresslessbreath.com/uploads/1/3/0/9/130969657/modutuzaxin.pdf
    • http://actutc.com/uploads/1/3/0/6/130621771/1146342.pdf
    • http://youthunitedforchrist.org/uploads/1/3/0/7/130775928/ragimigo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000391d4.bin
02c73e7413948d92d66a45ad1c08e041a8ab2bc9320e769215db4b32ce0c1784		 pdf-font-stream PDF embedded font (sfnt) at offset 0x391D4 8892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.