Malicious PDF — malware analysis report

Static analysis result for SHA-256 63b5d5a673147f42…

MALICIOUS

PDF

68.1 KB Created: 2021-03-12 09:40:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 54ba7799ec5a4c32f84fd4e1f067c38b SHA-1: 1257d6034556dd0952c9a694f608f2d04d4ff52e SHA-256: 63b5d5a673147f42b83cff91bf086b18b8d786474508937b8b3c48c229c43653
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into downloading a malicious file. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded URI suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8381

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=monroe+shocks+catalogue+south+africa+pdf
    • http://nizavevorupuj.mywebcommunity.org/maus_implement_russellville_ar.pdf
    • https://kosodakugup.weebly.com/uploads/1/3/4/6/134655388/nobugifi.pdf
    • http://fizolewafivemis.22web.org/how_to_put_a_vinyl_decal_on_a_tumbler.pdf
    • https://paxuxitusokewu.weebly.com/uploads/1/3/1/3/131380341/5795744.pdf
    • https://risegexof.weebly.com/uploads/1/3/4/6/134661868/4926623.pdf
    • http://ladujose.sportsontheweb.net/monopoly_cheaters_edition_rules_money_distribution.pdf
    • http://pobesegu.scienceontheweb.net/el_santo_rosario_biblico_meditado_apostolado_biblico_catolico.pdf
    • http://xofazonir.iblogger.org/zotuz.pdf
    • http://gekalam.22web.org/samsung_note_20_ultra_price_in_india_2020_amazon.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7fe6b731-3703-45da-bcbe-faf39b4d3392.filesusr.com/ugd/880a7e_620f72d12b904fe584df6fb527dbdd31.pdf?index=true
    • http://faxumev.epizy.com/commandos_behind_enemy_lines_free_utorrent.pdf
    • http://lenamopotinapar.epizy.com/43150483252.pdf
    • http://gulepoko.epizy.com/meaning_of_the_phrase_man_is_the_measure_of_all_things.pdf
    • http://xatidewivi.epizy.com/27773252189.pdf
    • https://2cc12256-1025-444a-bacb-901a9f007bda.filesusr.com/ugd/d1fcfc_dbe951059a5346b8b2123892d7aecc2e.pdf?index=true
    • http://zitoxilafeguxu.rf.gd/what_is_a_good_thesis_statement_for_cyberbullying.pdf
    • http://kogobobud.rf.gd/intermatic_timer_switch_not_working.pdf
    • https://56076a71-1b70-41e8-afe1-d547c394b4ee.filesusr.com/ugd/ab0d05_bb1edf61ebc2492db551d6a5ae8fbe2c.pdf?index=true
    • http://jabukejezari.epizy.com/acneiform_drug_reaction.pdf
    • http://mokisomalew.rf.gd/mantak_chia_london_real.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7bf.bin
3ad08afe56542e689171b71a4ef0ebf05e74a2d137f711b45000d4cf79ecaa9b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7BF 5484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.