Malicious PDF — malware analysis report

Static analysis result for SHA-256 62071cb34f7ae7e9…

MALICIOUS

PDF

67.6 KB Created: 2021-02-15 05:36:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 6c6936a2a13e09a84ac33be5259ec43e SHA-1: 35980be1eeb10f20ae8360819c76c3d199e0b1f3 SHA-256: 62071cb34f7ae7e9c10522817fe006135cf9bd6d14866c8d49dded63191609c0
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and the presence of an external URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9937

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/aws?utm_term=algebra+2+final+review+worksheet PDF link annotation
    • http://kyhni.site/bansuri_music_ringtone_free1v1e1.pdfIn PDF document text
    • http://reawolt.online/kelenafakakuwibomowipixautoyu.pdfIn PDF document text
    • http://lnstagramcopyrigtservice.com/overcomer_bible_study_bookvt2am.pdfIn PDF document text
    • http://probmaka.tech/lenen_und_partner_episodenguide_staffel_7hwcn5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tozaduliwubega/flow_tv_guide.pdfIn PDF document text
    • http://xuwugufufokiti.epizy.com/black_mermaid_sequin_bodysuit_missguided.pdfIn PDF document text
    • https://s3.amazonaws.com/ninazarila/administrative_officer_job_description.pdfIn PDF document text
    • https://s3.amazonaws.com/jevedijadiki/26777009352.pdfIn PDF document text
    • https://s3.amazonaws.com/xojafemori/beach_babies_full_movie.pdfIn PDF document text
    • http://japorununatoj.epizy.com/32916302313.pdfIn PDF document text
    • http://xepalufozakot.epizy.com/safunodinaxamavuduxawunip.pdfIn PDF document text
    • http://bewaxupu.rf.gd/xoredok.pdfIn PDF document text
    • https://s3.amazonaws.com/bifadiwuwileji/jewel_chicken_wings_nutrition_information.pdfIn PDF document text
    • https://s3.amazonaws.com/gixawetopoli/frutas_y_verduras_de_temporada_espaa.pdfIn PDF document text
    • https://s3.amazonaws.com/regovadeje/normal_consistency_of_cement_lab_report.pdfIn PDF document text
    • https://s3.amazonaws.com/nawuvud/addition_worksheets_for_grade_1_doc.pdfIn PDF document text
    • https://s3.amazonaws.com/sogovekevi/asian_games_2018_logo.pdfIn PDF document text
    • http://tomuvonunilo.epizy.com/does_brazilian_blowout_have_formaldehyde_2017.pdfIn PDF document text
    • https://s3.amazonaws.com/bojafazes/indigenous_knowledge_systems_in_south_africa.pdfIn PDF document text
    • http://zimemotom.rf.gd/whatsapp_status_sad_shayari_video.pdfIn PDF document text
    • https://s3.amazonaws.com/zupenafud/low_level_design_document_template_for_database.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f216.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF216 5508 bytes
SHA-256: df868799289890ce29b6b615b8f17bd445e44f66db26f6dbf81bce8503463c09

Open this report in the interactive analyzer, or submit your own file for analysis.