PDF malware analysis — malicious · 665dc36ed994288e

MALICIOUS

PDF

66.7 KB Created: 2021-06-12 06:12:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23

MD5: c7019da44db06c2dd1a0721e2245dcbb SHA-1: d215c42b39dd6f30429603fc59c248e4fbc0e793 SHA-256: 665dc36ed994288e73f53f8e723c2a58777b6ac0ef78f8361b58d6c2e6ce8dac

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.8526

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://huntic.ru/pbw?utm_term=ice+fire+mod PDF link annotation
- https://static.s123-cdn-static.com/uploads/4377128/normal_5ff87daa3b6e5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4468838/normal_600a562a85560.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4380223/normal_603b6c90f24e8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417313/normal_60471b869b1c1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450151/normal_602b5d0f2deae.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4469831/normal_6043b7a5aa2d1.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4473971/normal_5ff12e7a0f64b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4411701/normal_601a884330198.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/c8e2a150-f385-415a-853f-47f9e3f7d37b/which_are_the_best_nespresso_compatible_pods.pdfIn PDF document text
- http://jopamedet.pbworks.com/w/file/fetch/144452115/1395262071.pdfIn PDF document text
- http://subuzuj.pbworks.com/f/ruxovinabalakol.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6c5d62cb-5a9b-4f97-b67f-b691d5193a22/25093226604.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/68e1fb17-49bf-416b-8d0c-9a81b9132f7c/statically_determinate_and_indeterminate_beams_difference.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f6afaef7-0687-4932-814a-18f3c30f63e7/xumidewibetokarofagekafi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e3678e68-fb5b-4663-9a75-ca8fddae010e/fire_and_blood_part_2.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aef5bf31-5a63-4032-8b53-95e5d7fc2842/40419888157.pdfIn PDF document text
- http://fepazonavu.pbworks.com/f/jasitebugakegadefixu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9e64cd73-46fd-4a35-ac2f-69bd76d42d4c/information_technology_project_management_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/18f77780-89ef-4650-ba15-abfbe0eacc46/84560897189.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000df16.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDF16	4684 bytes
SHA-256: `033557c708c48a70d08961ea7c8af3c9af0f24c756948321e8dafa9d4d64c8d0`

Open this report in the interactive analyzer, or submit your own file for analysis.