Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e3df67d0195ea37…

MALICIOUS

PDF

72.2 KB Created: 2021-03-23 09:33:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 705b19768b7630d613b94527b0e6a6fe SHA-1: 3a0e18557b00933135e7d85d77d11658753b880c SHA-256: 7e3df67d0195ea37a1e3ae05854542cf88d5225d2d2e589636290f16b571cede
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL pointing to a suspicious domain, likely intended to deliver a malicious payload. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to downloading a PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=basic+integration+formulas+pdf+download
    • https://static.s123-cdn-static.com/uploads/4444377/normal_6007267985e25.pdf
    • https://zunexoxefa.weebly.com/uploads/1/3/5/3/135340588/bajiruzukumino.pdf
    • https://cdn.sqhk.co/pelopuxi/idX4Whg/foldersync_alternative_app.pdf
    • https://cdn.sqhk.co/piwuzuberaze/gggjihj/64509425942.pdf
    • https://cdn.sqhk.co/zaniridut/dXhgijj/basketball_court_size_elementary_school.pdf
    • https://static.s123-cdn-static.com/uploads/4492536/normal_5fcaf40bb418c.pdf
    • https://cdn-cms.f-static.net/uploads/4487626/normal_60391c2870431.pdf
    • https://rebodegumirimak.weebly.com/uploads/1/3/0/7/130775130/zufanaziz.pdf
    • https://static.s123-cdn-static.com/uploads/4374848/normal_5feb4214ab5bc.pdf
    • https://cdn-cms.f-static.net/uploads/4453560/normal_5fd6814a7d42f.pdf
    • https://cdn.sqhk.co/xubipoxeguza/ieHNijs/anime_with_robots_and_aliens.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://19a39513-20cc-49d1-a75c-e30ce0314142.filesusr.com/ugd/f99735_600b721ab253402388e4b40919389768.pdf?index=true
    • https://e60c805d-b9e1-47fc-b045-983511e9ac1f.filesusr.com/ugd/116bb2_88731603adde4854ad94ea4bd36d47e2.pdf?index=true
    • http://keluwuvofaj.epizy.com/9660430135.pdf
    • http://fiwixowu.rf.gd/piriformis_muscle_compressing_the_sciatic_nerve.pdf
    • https://4a39c6c9-989b-4d11-b2d8-cc0becc7f193.filesusr.com/ugd/ef0078_48f847556cc045818a994d756fd8af5b.pdf?index=true
    • https://204833c8-abda-4421-8777-5048ee7dd919.filesusr.com/ugd/e30b7a_a3069c20bdf849b2bed8438f96ed6f7e.pdf?index=true
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb4a.bin
343628acd0d60a7873d37c2d1bef09f845024422680273c23a4c3ae649893e5a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB4A 7292 bytes
font_01_sfnt_off00010e0c.bin
3f4d5d0b5c4efee3aa268c9867e57383b3ea0065fea303d8d0fb85ff9a877873		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E0C 5616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.