Malicious PDF — malware analysis report

Static analysis result for SHA-256 690fa9521b11aa23…

MALICIOUS

PDF

59.9 KB Created: 2021-03-19 21:54:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9cc99ae83116894258c76fc46c1088d3 SHA-1: 7c04196c961aa33f2eb741da6ca46a9b89836972 SHA-256: 690fa9521b11aa23055564d41da0f0cf28261205d287fbdf14cc5ca03dd6c1fd
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating the presence of external URIs and is flagged by a machine learning classifier and ClamAV as malicious. The embedded URL points to a domain that appears to be used for phishing or malware distribution. The document body, though heavily obfuscated, contains text related to technical documents, suggesting a lure to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7659

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=microwave+transistor+amplifiers+analysis+and+design+guillermo+gonzalez+pdf
    • http://lobulezinovux.medianewsonline.com/how_to_reset_westinghouse_tv_without_password.pdf
    • https://cdn.sqhk.co/gegefemorosu/jdELghc/3_mystery_words_level_7.pdf
    • https://tizukusijevawus.weebly.com/uploads/1/3/4/4/134454617/9884021.pdf
    • https://cdn.sqhk.co/puzadowoke/yjhLMic/7465526448.pdf
    • http://gemajelibetojup.scienceontheweb.net/89672209580.pdf
    • http://vedivux.mygamesonline.org/piano_arpeggio.pdf
    • https://cdn.sqhk.co/jojevirelo/Yhjhgjb/smart_tv_sales_cyber_monday.pdf
    • https://cdn.sqhk.co/milatepoz/fiejfhj/cat_jumps_on_counter_with_aluminum_foil_tiktok.pdf
    • https://jigugupidutugi.weebly.com/uploads/1/3/0/8/130813301/b9c7c04f9b4ef4.pdf
    • https://cdn.sqhk.co/loxexafetivu/biiZ0gh/dajegaxux.pdf
    • https://cdn.sqhk.co/jezaziritav/qhegio0/blackpink_members_instagram.pdf
    • https://moxizeza.weebly.com/uploads/1/3/3/9/133999163/ed10ead60842d1.pdf
    • https://fazotevepokok.weebly.com/uploads/1/3/4/8/134865813/xitagijimeboton-budabuveg-nizupirosim.pdf
    • https://cdn.sqhk.co/tumowara/rRhdgjQ/joy_music_free_music.pdf
    • https://pudodogefelareb.weebly.com/uploads/1/3/1/6/131606347/mibisugo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/bewibiwat/1708603776.pdf
    • http://miganuvag.myartsonline.com/liver_cirrhosis_guidelines.pdf
    • https://s3.amazonaws.com/betefowubevat/dvdvilla_bollywood_2019.pdf
    • http://tarepos.onlinewebshop.net/asp.net_mvc_or_asp.net_core_mvc.pdf
    • https://s3.amazonaws.com/bajapovogam/63171237379.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e13d.bin
b40acbd77208f4315ef8cafdb45a08561685062a7e546ae4caff834ea205069c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE13D 5784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.