Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a69e8f40c5be042…

MALICIOUS

PDF

66.6 KB Created: 2021-06-10 02:53:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bb7dd2f47fbf460c9c84515dd2624bc6 SHA-1: 14769f0e8d134f63076f9eca05bd9e4d4d9565f6 SHA-256: 5a69e8f40c5be04203bea1c6f96351c983a212474317ab493cd2f17987d5f1eb
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to 'queure.ru', which is likely part of a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8273

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/pbw?utm_term=the+theory+of+investment+value+pdf+download
    • https://cdn-cms.f-static.net/uploads/4450426/normal_60445a28d076b.pdf
    • https://static.s123-cdn-static.com/uploads/4477400/normal_5febd1b73da9a.pdf
    • https://saposoralax.weebly.com/uploads/1/3/6/0/136025319/pijizulujekena-rakosa-dovep.pdf
    • https://cdn-cms.f-static.net/uploads/4387713/normal_600d5e6d2611d.pdf
    • https://cdn-cms.f-static.net/uploads/4425214/normal_60465bc122d1e.pdf
    • https://cdn-cms.f-static.net/uploads/4490001/normal_603e40321abce.pdf
    • https://dixawofira.weebly.com/uploads/1/3/5/3/135303501/vabexusafikanemunovi.pdf
    • https://fujinimozebuxe.weebly.com/uploads/1/3/0/7/130738673/mixujemive.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://luwosotatex.pbworks.com/f/puvogadizojidem.pdf
    • https://uploads.strikinglycdn.com/files/27f81015-4515-4812-b241-c28327732175/nujapenor.pdf
    • https://uploads.strikinglycdn.com/files/6126f17b-ad55-41d3-a9e2-529115e426e8/fit_for_life_meal_plan_crystal.pdf
    • http://zuwofig.pbworks.com/f/feguzuzegopejiponig.pdf
    • http://jisopubo.pbworks.com/f/jikusumaku.pdf
    • http://buvavipoluvu.pbworks.com/f/best_percussion_massage_gun_under_200.pdf
    • http://rujuboxu.pbworks.com/f/convertir_xml_3.3_a_cfdi_gratis.pdf
    • https://uploads.strikinglycdn.com/files/023c02c1-7162-4d56-ab15-8b00a795632e/can_you_fry_turkey_chops.pdf
    • https://uploads.strikinglycdn.com/files/772f7faf-52c5-49a2-807e-c71d713dc12d/55497035393.pdf
    • https://uploads.strikinglycdn.com/files/6c29d2ba-dc69-48f1-8808-b8902076584a/anatomy_and_physiology_coloring_workbook_answer_key_chapter_8.pdf
    • http://muzurinugaw.pbworks.com/w/file/fetch/144837963/t_sql_tutorial_deutsch.pdf
    • http://sokulus.pbworks.com/w/file/fetch/144477219/99453443719.pdf
    • http://gibudufu.pbworks.com/w/file/fetch/144591300/twilight_saga_breaking_dawn_part_1_movie_watch_online_free.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f02e.bin
58b76dc7d909f94b31723bf5b9139cc85df6fb79d97e8454f59fa55a8e9bb062		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF02E 5484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.