PDF malware analysis — malicious · 42b3f461c800bc73

MALICIOUS

PDF

96.8 KB Created: 2021-03-25 05:55:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 2e1f5b9494871637e0ce40eaae84b1ed SHA-1: 05779abeef7ae96a079f141b6ed02b8c485db472 SHA-256: 42b3f461c800bc736a660f47d807d51c75610dd2e14a2052c26dd0e053a97475

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to 'funcion del pancreas endocrino pdf'. No scripts were extracted, but the presence of an external URI is a strong indicator of a phishing attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.7282

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://baarspo.ru/award?keyword=funcion+del+pancreas+endocrino+pdf
- http://gudokav.sportsontheweb.net/structure_of_saturated_fatty_acid.pdf
- http://delinapod.mypressonline.com/bogawevigokuxejit.pdf
- http://igonlinesupport.com/lowrance_hook_3x_transducer_installation505jj.pdf
- https://static.s123-cdn-static.com/uploads/4505358/normal_5ff3c1fbe1f22.pdf
- https://cdn-cms.f-static.net/uploads/4459777/normal_605c00fd3dbd0.pdf
- http://dapajurop.mygamesonline.org/sennheiser_ew_100_eng_g4_wireless_camera_lavalier.pdf
- https://cdn-cms.f-static.net/uploads/4367925/normal_60461485b4827.pdf
- https://cdn-cms.f-static.net/uploads/4490256/normal_604fc525e402f.pdf
- http://idealica-co.site/folowowobupufej097y.pdf
- https://cdn-cms.f-static.net/uploads/4469643/normal_60145b8980c07.pdf
- https://cdn-cms.f-static.net/uploads/4374537/normal_600a0336224e6.pdf
- https://cdn-cms.f-static.net/uploads/4368954/normal_6027c0dad3c53.pdf
- http://milktree.store/hcf-2_transmission_fluid_napaqwvem.pdf
- https://cdn-cms.f-static.net/uploads/4368741/normal_601bdfb412201.pdf
- https://cdn-cms.f-static.net/uploads/4365655/normal_6029969fb8dcf.pdf
- http://peludofnor.fun/kilizigzhwc1.pdf
- http://bumomuvo.iblogger.org/simile_worksheets_grade_2_tagalog.pdf
- https://cdn-cms.f-static.net/uploads/4465703/normal_603c27f7e4f3c.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/99c31612-1dbd-4ea4-acf0-f4dd0e17ddea/85001526159.pdf
- https://uploads.strikinglycdn.com/files/09e310cd-1f83-47f3-8a83-9beac7673e3c/how_much_for_casio_watch.pdf
- http://tuxolemoga.epizy.com/yield_return_vs_list_performance.pdf
- http://filazit.epizy.com/halo_reach_pc_game_highly_compressed.pdf
- https://uploads.strikinglycdn.com/files/617af1ab-4acb-4da9-9c9f-3f2ef513010e/how_to_draw_anime_girl_easy_step_by_step_for_beginners.pdf
- https://uploads.strikinglycdn.com/files/3cc7699c-4e5c-4341-ae8b-5c37b695d9b6/how_to_take_apart_a_vicks_warm_mist_humidifier.pdf
- http://jotikovan.rf.gd/pujikevedipojugugasinuge.pdf
- http://nowonijefug.rf.gd/are_the_grandmaster_and_the_collector_brothers.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000154b6.bin` `58644e165bb0c9909b6483f68352ed3316d03eb9661b3d44702983f5cb64b801`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x154B6	5104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.