Malicious PDF — malware analysis report

Static analysis result for SHA-256 7fcb39bae5c26eca…

MALICIOUS

PDF

75.6 KB Created: 2021-03-10 10:00:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9e0ee561d58ff83945a32dc3d7585af5 SHA-1: a084c27c7620d5710c7d30df1374e76b6a8fde46 SHA-256: 7fcb39bae5c26eca1c66a51c0849675b7abefb368201aa262372e0b4c77f8d9f
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a critical heuristic flagging it as Pdf.Phishing.Trojan. The document body, though heavily obfuscated, contains text related to 'Syma x5c-1 transmitter instructions' and an external URI pointing to 'lozipotod.ru', suggesting a phishing lure. The presence of PDF_URI and embedded URLs indicates an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9761

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/aws?utm_term=syma+x5c-1+transmitter+instructions
    • https://static.s123-cdn-static.com/uploads/4391001/normal_5ff6729915c18.pdf
    • http://fikakutipid.mygamesonline.org/ain_t_misbehavin.pdf
    • http://gexomafe.mypressonline.com/purabuvawofemanosedeludar.pdf
    • https://cdn.sqhk.co/kixowijeka/XFvjj3x/liwanujolifipanadirukus.pdf
    • https://cdn.sqhk.co/kelulegawi/5cNijji/kuxovetumi.pdf
    • https://static.s123-cdn-static.com/uploads/4409813/normal_5ff4b807a4518.pdf
    • https://static.s123-cdn-static.com/uploads/4445324/normal_5ff2c12e13377.pdf
    • https://static.s123-cdn-static.com/uploads/4419441/normal_600937eed7d41.pdf
    • https://static.s123-cdn-static.com/uploads/4462379/normal_5fd0417d971bc.pdf
    • https://cdn.sqhk.co/zisujidixa/ejdhezM/zeus_network_the_conversation_hazel_e.pdf
    • https://cdn-cms.f-static.net/uploads/4375521/normal_601461fe32cce.pdf
    • https://cdn-cms.f-static.net/uploads/4376099/normal_602088669c53c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zezevefo.rf.gd/zozafuxewez.pdf
    • https://uploads.strikinglycdn.com/files/755f89ff-da48-4a1a-9c06-668e36f1f632/sentence_starters_ed_words.pdf
    • https://uploads.strikinglycdn.com/files/33a4356a-1aa6-4ed3-bfff-9e00a9fa94cc/burger_king_menu_prices_and_offers.pdf
    • https://uploads.strikinglycdn.com/files/f9d0026f-f12f-41fb-b842-8b925b921cea/factory_reset_command.pdf
    • http://gonigitipobezom.epizy.com/betty_crocker_picture_cookbook_1950_1st_edition.pdf
    • http://zupitatip.atwebpages.com/how_to_cook_meat_in_pressure_cooker_xl.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001183d.bin
e416a69f2f2e0d9b5b244c2c97b54ba545b6c469976e5b2f37e9e470ad2e7d4b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1183D 5396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.