Malicious PDF — malware analysis report

Static analysis result for SHA-256 4254b81743086a5c…

MALICIOUS

PDF

70.9 KB Created: 2021-03-03 19:50:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: fc1e1d74d530a3aea3e6bb2a7e0049b2 SHA-1: 8d05866c14b532ef9dab852634a620c5fa3e1637 SHA-256: 4254b81743086a5cee0ca4cc2f98cf0c3c16cd12344ac552ca8b405a4569a241
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, which is also flagged by heuristics as malicious. The document body, though heavily obfuscated, appears to be a search result for a product, likely a lure to encourage clicks on the malicious link. No scripts were extracted, but the PDF structure itself facilitates the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9649

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=which+omron+wrist+bp+monitor+is+best PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4420468/normal_6013463e954f2.pdfIn PDF document text
    • http://gifinibufenatar.medianewsonline.com/how_to_fix_tv_with_no_picture_but_sound.pdfIn PDF document text
    • https://cdn.sqhk.co/vukupamita/biihahf/drones_used_to_attack_saudi_aramco_pumping_stations.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426820/normal_600f92bc4ebcb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446394/normal_5fc575324b598.pdfIn PDF document text
    • https://cdn.sqhk.co/kewawukufiju/rciiXii/battle_chasers_nightwar_2_switch_price.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370560/normal_6038fb4594dea.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417029/normal_6005410797438.pdfIn PDF document text
    • http://sozimaxetupow.mywebcommunity.org/what_are_some_good_bible_scriptures.pdfIn PDF document text
    • https://cdn.sqhk.co/biwizalibe/ihZE1aC/kingdom_pixel_art_game.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xesigeze/visiting_card_template_word_file.pdfIn PDF document text
    • https://s3.amazonaws.com/bepukuba/weather_report_las_cruces_mexico.pdfIn PDF document text
    • https://s3.amazonaws.com/goviwigax/25227160317.pdfIn PDF document text
    • http://xuxirifuv.rf.gd/chrome_mod_apk_2019.pdfIn PDF document text
    • http://girofili.myartsonline.com/how_to_configure_netgear_wgr614_wifi_router.pdfIn PDF document text
    • http://pabotojixupi.atwebpages.com/burger_king_dec_2020_promotion.pdfIn PDF document text
    • https://s3.amazonaws.com/tiduro/android_error_google_play_services_keeps_stopping.pdfIn PDF document text
    • http://baxewape.myartsonline.com/how_to_start_a_theme_essay.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010890.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10890 5176 bytes
SHA-256: 18ba8b53c2cf9a4172cd30957dc2e6794dd097d25567cef7ecaba4bc1a6afdd3

Open this report in the interactive analyzer, or submit your own file for analysis.