Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bc4867509165671…

MALICIOUS

PDF

76.3 KB Created: 2021-03-19 15:58:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5293570a27a05c814bcb70278296262c SHA-1: e0d61a0fb37e7c2d29e2c8142410bff943928075 SHA-256: 7bc4867509165671a420272ceba3a82bd3d8a3c2cbf9f777087f7999dbfe8f6e
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a phishing site. The document body, though heavily obfuscated, appears to be a lure related to 'Discoveries and opinions of galileo'. The presence of an external URI heuristic and the ML classifier flagging it as malicious strongly suggest a phishing attempt. No scripts were extracted, but the PDF structure itself facilitates the redirection to the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8947

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=discoveries+and+opinions+of+galileo+pdf
    • https://cdn.sqhk.co/tuwetebep/uJHrNij/uber_request_a_ride_phone_number.pdf
    • https://cdn.sqhk.co/xenivoronizu/dPXsUic/15793172309.pdf
    • http://xisumagogali.getenjoyment.net/lixesebel.pdf
    • http://nutosuvitiraj.scienceontheweb.net/rifidomoxojanen.pdf
    • https://cdn.sqhk.co/pijuvedozuw/ajihejg/basarivebozasevopum.pdf
    • https://cdn.sqhk.co/rufosopufu/hchejbZ/pulse_rate_normal_for_male.pdf
    • https://cdn.sqhk.co/vefemenivu/ggjmZhi/89159701048.pdf
    • https://cdn.sqhk.co/jumivosokigo/hjQjchb/wuwumilesobudididegir.pdf
    • https://cdn.sqhk.co/mezutorixo/kiVie3g/jefubemufudanode.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/dowesitobuga/nudopekumamedix.pdf
    • https://uploads.strikinglycdn.com/files/75de2d6b-7670-46bd-98c0-4254b618f0ef/34729743466.pdf
    • https://uploads.strikinglycdn.com/files/1738fbb4-99a1-47cf-aee1-9c823b9864e0/is_the_japanese_economy_good.pdf
    • https://s3.amazonaws.com/falufusu/crusader_ragnarok_mobile_guide.pdf
    • https://uploads.strikinglycdn.com/files/b974ff21-ac6c-48b2-9ddc-1013b10e487f/fagugumuzinorolud.pdf
    • https://uploads.strikinglycdn.com/files/31e5fb47-56f2-4ff2-915b-5c661123e461/redawojodogalakafolek.pdf
    • https://s3.amazonaws.com/rovikibixu/in_jackson_heights_movie_streaming.pdf
    • https://uploads.strikinglycdn.com/files/b4676f08-d67c-46e3-8810-e6c9cf79e7d2/resumen_del_capitulo_15_al_20_de_cien_aos_de_soledad.pdf
    • https://uploads.strikinglycdn.com/files/2bb7130f-872e-4db6-b91c-d4df32b4d0ce/what_makes_a_good_coaching_philosophy.pdf
    • https://uploads.strikinglycdn.com/files/a2643c97-fff5-44c4-bb62-b8ff7c67b82e/7250667195.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000109c8.bin
8c00439aac66ac2178a76b3395a1283d6736d84ed41aca3fdd9f01038308d24f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109C8 5088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.