Malicious PDF — malware analysis report

Static analysis result for SHA-256 442d8be69d994fb1…

MALICIOUS

PDF

68.1 KB Created: 2021-03-11 02:35:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 010221ee8c3e57e6e488be0caceb86ae SHA-1: 91ee3544c88684876cd4fc401aa5209f40694931 SHA-256: 442d8be69d994fb1e74f5ba91295906e6ba3bda2cc01588b276451c5607ab721
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by multiple heuristics, including a ClamAV detection for 'Pdf.Phishing.Trojan'. The presence of an external URI pointing to a suspicious domain, combined with numerous embedded URLs, suggests a phishing or credential harvesting attempt. The document body, though heavily obfuscated, contains metadata related to PDF creation, reinforcing the document-based attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8239

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/award?keyword=conductores+y+aislantes+termicos+pdf
    • https://cdn.sqhk.co/wubofuse/ggigjfC/baby_dream_house.pdf
    • https://cdn.sqhk.co/bapisolel/NjaGgfq/strategy_pattern_c_enum.pdf
    • https://static.s123-cdn-static.com/uploads/4459939/normal_5ffdd12dd5163.pdf
    • http://ueuniti.xyz/drinking_water_guidelines_uksc8qd.pdf
    • https://cdn.sqhk.co/dezorevukor/hi6Xogi/samsung_music_pour_pc.pdf
    • https://cdn.sqhk.co/bepeguvovori/Hieshjf/amf_bowling_unlimited_games.pdf
    • https://cdn.sqhk.co/zalopubid/ibhb7jb/fake_call_from_chucky_scary_doll_prank.pdf
    • http://wiinorama.website/24487213008e3v5a.pdf
    • http://submonster.xyz/92611677904lvgbx.pdf
    • http://moscow-siberian-force.online/is_wendys_harvest_chicken_salad_healthy9lf90.pdf
    • https://cdn-cms.f-static.net/uploads/4455639/normal_6037e57c872b3.pdf
    • https://cdn.sqhk.co/kawaniroti/hd4kgcc/transformers_robots_in_disguise_season_3_episode_17.pdf
    • https://static.s123-cdn-static.com/uploads/4383702/normal_5fcbf71132c47.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://aefbb2f1-1cfc-4a48-aab2-d72547d84173.filesusr.com/ugd/2f3ac6_e83f6e5d475f4cd9b8feda89ae1779b9.pdf?index=true
    • https://72b50e20-f79f-40ca-96b4-24bef83e308f.filesusr.com/ugd/1a1092_7fe11a6d18c647269fb86f0af2288ffa.pdf?index=true
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e064.bin
428dd7f09f0555f403fc0891122dd58fcd1cd19ab01f4468335f15db91705e14		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE064 5308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.