Malicious PDF — malware analysis report

Static analysis result for SHA-256 417c27a9598e6826…

MALICIOUS

PDF

64.3 KB Created: 2021-06-06 20:07:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fd46f251f2541c9d2349777ed0586a6a SHA-1: 079927ecfe1111cccd67a776f7de4bc65c399fac SHA-256: 417c27a9598e682680cacc820da06fd067faa301dc0b5d192bd91f570247bc29
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF document identified as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to a URL that mimics a search result for a popular media download, likely a lure to entice users to click and download further malicious content. The document body, though heavily obfuscated, contains metadata related to its creation and the lure itself.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9945

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/uplcv?utm_term=mahabharat+serial+star+plus+title+song+download
    • https://lawpropertyconsultants.co.uk/wp-content/plugins/super-forms/uploads/php/files/3j3rjvg381t346qukp5ib51ams/satosinetifavuge.pdf
    • https://autoschiller.de/wp-content/plugins/formcraft/file-upload/server/content/files/16075d8cc7153f---55852247516.pdf
    • http://geologicatoscana.eu/userfiles/files/14444763427.pdf
    • http://modelkyujin.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ee9e2cc9ef---92307268193.pdf
    • https://hsegroup.ru/wp-content/plugins/super-forms/uploads/php/files/99mjop9bkuuse1lhagirkqd2f4/21122654630.pdf
    • https://rockdental.co.uk/wp-content/plugins/super-forms/uploads/php/files/68cc86f74d43ee4408d75550a3dbf4e5/bufiturokunakadofojatexu.pdf
    • https://www.sahabatkeluargahomecare.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c82758b8f8---teladakowibilutoliv.pdf
    • http://afghansolar.com/userfiles/file/febapawedezibuk.pdf
    • http://cnex.cc/images/blog//file/41118623018.pdf
    • http://www.publicitymailing.ie/wp-content/plugins/formcraft/file-upload/server/content/files/16087842a350fb---zeliv.pdf
    • https://www.scilights.com/wp-content/plugins/super-forms/uploads/php/files/dab181491a5563bfdb7961aa56b58d02/5784443328.pdf
    • http://www.hptindia.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086a63c2dd13---90330346894.pdf
    • http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/160b9aca6e5035---76420170965.pdf
    • https://regalcabs.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160bb99c446a8f---64301887089.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cbc0.bin
14a81afa0c95e50440981f1e7bd5ce8a8d78304a12266732c37e54da0500bb5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCBC0 5460 bytes
font_01_sfnt_off0000de60.bin
bc57e59ad9263cea5bc5285c4ddf1fc94272375b88da1ec55e3c22e43b8000f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE60 10496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.