Malicious PDF — malware analysis report

Static analysis result for SHA-256 47a265f4682e181b…

MALICIOUS

PDF

60.3 KB Created: 2021-06-01 10:08:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f58d75040df346f0d24de034b1e79510 SHA-1: 88581fb70bd0a168ec0d287ba20430f933399396 SHA-256: 47a265f4682e181b379cd7be38ee108ac7b04a422c473a84e99f7b03618662d4
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains embedded URLs that likely serve as lures, directing users to download further malicious content. The document body, though heavily obfuscated, suggests a phishing pretext related to accounting information systems.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9938

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://sckprime.com/wp-content/plugins/super-forms/uploads/php/files/310538ae8306e1abacb810f4815b7761/wurepegidem.pdf
    • https://spencershaulageltd.co.uk/wp-content/plugins/super-forms/uploads/php/files/26513037a659ab23f5d83e8131f3adad/32471978504.pdf
    • https://dacinsara.ro/fckfiles/file/javalajixez.pdf
    • https://www.ideaklinik.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1609d4ecb8e81f---nesokepofuwamo.pdf
    • https://humanistbeauty.com/wp-content/plugins/super-forms/uploads/php/files/ps9cfh8o9npnpjoeo05gsmoc8l/28327505298.pdf
    • http://ziepniekkalns.lv/wp-content/plugins/formcraft/file-upload/server/content/files/160a6054425f2a---jitonomedalupupekakuriju.pdf
    • https://harpethvalleyhealth.com/wp-content/plugins/super-forms/uploads/php/files/5088d223fb80ec2ca9b04dfacf2241fd/29635600646.pdf
    • https://ahreco.com/uploads/news_file/vazutidi.pdf
    • http://bjoybrands.com/wp-content/plugins/formcraft/file-upload/server/content/files/160865c8ee3f73---lezojavi.pdf
    • https://retentionstudentexperience.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609aecff23f7e---85229304364.pdf
    • https://www.tessilgiada.it/wp-content/plugins/formcraft/file-upload/server/content/files/1609405f55e5a9---3435364919.pdf
    • https://pankalconstructora.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b5a3bd40423---nonunifidadepiwanagixe.pdf
    • https://sumangold.net.vn/wp-content/plugins/super-forms/uploads/php/files/ivt6jt33h1f08pu0jcmn221hna/38073828636.pdf
    • http://poorclarescork.ie/images/vovawijiwipalite.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/cv9VXjIrmdE/uplcv?utm_term=what+is+revenue+cycle+in+accounting+information+systems
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d838.bin
c4468800a912351b34896594337c2cb60ce31a3abf8f25e36ae7c1cb258e2500		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD838 5468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.