PDF malware analysis — malicious · 795106ce9e21d425

MALICIOUS

PDF

84.3 KB Created: 2021-03-30 17:32:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13

MD5: c11f8a317706dd5755c18bb7a9268afc SHA-1: bedbdf79d92e417f9b8988fd9489084c89f37dd4 SHA-256: 795106ce9e21d4254ced4fb4ce4fa63bc3caf759fcf41bed0aaef3b7260a4b27

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL suggests a phishing lure, attempting to trick users into downloading a fake award document. While no scripts were explicitly extracted, the PDF structure and embedded URIs are consistent with a phishing campaign designed to deliver further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.8762

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/award?keyword=principles+of+business+information+systems+pdf+download PDF link annotation
- http://voirly.xyz/bangalore_to_chennai_shatabdi_platform1xjgq.pdfIn PDF document text
- https://junezemojevav.weebly.com/uploads/1/3/2/7/132740237/terufowe.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4488323/normal_5ffaafe43222c.pdfIn PDF document text
- https://cdn.sqhk.co/tinolaseja/gjbPhfV/widubabiniwefikawiwogogil.pdfIn PDF document text
- https://cdn.sqhk.co/pamezuravuno/Vedhb8l/84494050270.pdfIn PDF document text
- https://vadizomozizi.weebly.com/uploads/1/3/5/4/135400682/banixopuzumoles.pdfIn PDF document text
- http://creditstar-kabinet.com/111291935332fpcy.pdfIn PDF document text
- https://cdn.sqhk.co/xovujiroveg/DShaahe/wedikiginosujiju.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4402964/normal_5ff6708195e52.pdfIn PDF document text
- https://disepijov.weebly.com/uploads/1/3/1/4/131438002/0f017771cc4.pdfIn PDF document text
- https://rofoxanubojinud.weebly.com/uploads/1/3/2/7/132740779/3885aee09fd7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495837/normal_605971415ebb1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4414849/normal_5fd2e656024a5.pdfIn PDF document text
- https://rasegopejut.weebly.com/uploads/1/3/4/3/134317160/4520489.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/ruzumeb/chiral_and_achiral_worksheets.pdfIn PDF document text
- https://s3.amazonaws.com/libowebujakux/hoodoo_ski_report_weather_forecast.pdfIn PDF document text
- https://s3.amazonaws.com/mikibetiv/free_printable_literacy_worksheets_ks1.pdfIn PDF document text
- https://s3.amazonaws.com/topipovikapari/41636813539.pdfIn PDF document text
- https://s3.amazonaws.com/bepukuba/what_are_electric_type_pokemon_weak_too.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000117bf.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x117BF	5636 bytes
SHA-256: `28688b85d99129dda8a1812114c66df8d79f3aba6f12c8e9813af97bc9ea8fc6`
`font_01_sfnt_off00012ae1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12AE1	11708 bytes
SHA-256: `7e54a937c2e9ec72734b41e0a8357c95903a2888b95769bb18d2ad1000df7785`

Open this report in the interactive analyzer, or submit your own file for analysis.