PDF malware analysis — malicious · 86863da9cf0a8bec

MALICIOUS

PDF

67.6 KB Created: 2020-11-24 05:08:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 61293e21a3cf013c99ce6eeb0c801b3e SHA-1: d5d600adb7da7501f8560a1a1d5fb01df731c274 SHA-256: 86863da9cf0a8becba54af1c16c30e14767831a8573d0cd30c7be824c694a363

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document body contains a link that, while appearing to offer free music downloads, is likely a lure to a malicious site. The presence of an external URI points towards an attempt to download further payloads or redirect the user to a phishing site.

Machine Learning

Nyx PDF Classifier malicious score 0.7539

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffking.ru/strik?utm_term=mangala+isai+nadaswaram+with+thavil+mp3+free+download
- https://cdn-cms.f-static.net/uploads/4375352/normal_5f89d4b09ca84.pdf
- https://cdn-cms.f-static.net/uploads/4424027/normal_5fbc5e259761f.pdf
- https://cdn-cms.f-static.net/uploads/4403428/normal_5fbb3ad0d5a17.pdf
- https://cdn-cms.f-static.net/uploads/4371004/normal_5f948d14bd0a4.pdf
- https://cdn-cms.f-static.net/uploads/4418170/normal_5fb382be80acd.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/68e661df-ff2f-46b8-aee9-b88f33a0dc7a/seminole_county_fl_property_tax_bill.pdf
- https://s3.amazonaws.com/tevigotu/60270975475.pdf
- https://s3.amazonaws.com/wivunonovef/75045038428.pdf
- https://s3.amazonaws.com/susopuzupure/rinuzafimexodono.pdf
- https://uploads.strikinglycdn.com/files/995f27d8-dc41-474b-80bf-795b41c46f04/dummy_never_fails_unblocked_games.pdf
- https://s3.amazonaws.com/fulosobezur/android_app_to_download_youtube_video.pdf
- https://s3.amazonaws.com/tosevud/gifosenodemik.pdf
- https://s3.amazonaws.com/muwemivumazulax/csulb_spring_2020_calendar.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d371.bin` `2f32373152b86590eb5c993bf8dbb57d20fc33770b92bc1ec6b5fd985d660553`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD371	2828 bytes
`font_01_sfnt_off0000dd7a.bin` `55344546f1f2ca9d8f47c6c9870e75f7a44c60fddc43fb1c350b67fc26ab8259`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDD7A	5776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.