Malicious PDF — malware analysis report

Static analysis result for SHA-256 708a61cbda4e6770…

MALICIOUS

PDF

61.1 KB Created: 2021-01-11 12:49:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 2a7f0743cea8f49bbdf5829183adac0e SHA-1: 7e899ab5f946c11bd3c129c2b33bf53cca974ede SHA-256: 708a61cbda4e67703af6c312c4851aa97bdaf439d0d0a4bfef6c898a57ed2f4b
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to a suspicious domain, which is likely used for phishing or to download further malicious content. The document body, though heavily obfuscated, contains text that appears to be a lure for popular media, suggesting a social engineering tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7814

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=suit+punjabi+1080p+hd+video+song PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4379626/normal_5ff7593c759d3.pdfIn PDF document text
    • https://site-1175348.mozfiles.com/files/1175348/building_a_chatbot_in_python_using_flask.pdfIn PDF document text
    • https://gituruledutaza.weebly.com/uploads/1/3/4/4/134401886/zoxivu_teguvagotuxeb_dujexazavivelu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420599/normal_5f98e88f51001.pdfIn PDF document text
    • https://cdn.sqhk.co/dofexoxev/gihibgs/mivixuxirizaxeziwi.pdfIn PDF document text
    • https://xikoroto.weebly.com/uploads/1/3/4/3/134338579/bb2b5b7ec5fa0.pdfIn PDF document text
    • https://rozazokosu.weebly.com/uploads/1/3/0/8/130813972/ceb57296b5774.pdfIn PDF document text
    • https://cdn.sqhk.co/wuvupalib/cidhbjc/tizobotipo.pdfIn PDF document text
    • https://norumevi.weebly.com/uploads/1/3/0/9/130969469/837891.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db38.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB38 5860 bytes
SHA-256: a462aeccf155be107c13bad000b1ed05b328024d4865bb324246c66783642c08

Open this report in the interactive analyzer, or submit your own file for analysis.