Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d16f70f98826157…

MALICIOUS

PDF

275.0 KB Created: 2020-04-18 06:46:32 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b5cbfea788ebcbc5c23b27ba47ffaf31 SHA-1: 25cf7e315c4c36a7ae360478ccbcbc3d14b94a8d SHA-256: 8d16f70f98826157f3c013ccdc4097dbf885b5d776e36768a26ebeb7d85e1d9c
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document was flagged by a machine learning classifier and exhibits characteristics of an advance-fee scam, specifically mentioning lottery winnings and parcel delivery requirements. The embedded URL points to a document that likely contains further details or instructions for the scam. No scripts were extracted from this sample, limiting the analysis of its direct execution behavior.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5216

Heuristics 3

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://btlanglandscape.com/uploads/1/3/0/3/130379596/130379596.html#bhagwat+geeta+in+sanskrit+pdf
    • http://wildstampedebbq.com/uploads/1/3/0/9/130969699/bilexinam_xugasopak_gevekuwena.pdf
    • http://dealerfly.net/uploads/1/3/0/5/130544384/fumifazotomidufag.pdf
    • http://morningtonpeninsuladjs.com/uploads/1/3/0/8/130813931/523ba96997f1.pdf
    • http://fantasticflooring.net/uploads/1/3/0/3/130323301/matikejas-xebaxasevupe.pdf
    • http://i-airconditioning.com/uploads/1/3/0/5/130551279/3205988.pdf
    • http://theccu.net/uploads/1/3/0/9/130969938/nebugagipebu.pdf
    • http://vingraph.studio/uploads/1/3/0/7/130739433/848887.pdf
    • http://thetadeltaiotamualumni.com/uploads/1/3/0/5/130589094/4782d75b987a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003a2cb.bin
3d12f45d153dce85052cdea1c05a57a8f4db9254ae696448aa1ee859a268b877		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A2CB 15772 bytes
font_01_sfnt_off0003cdb7.bin
0253a727354717674627225e4517c1bcf2cd9de9f0e2d345a7bc55bd6fcbcca1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3CDB7 11760 bytes
font_02_sfnt_off0003f573.bin
ea1f6e48ddc2f0c73ab1adb9f53444edc4834e1d675de0e961ffaae9b5b728da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3F573 3024 bytes
font_03_sfnt_off00040009.bin
0af5a2e18eaa1fa3d2be86e14582fa4350d5a2a2086a98592bc5d410cdb1b553		 pdf-font-stream PDF embedded font (sfnt) at offset 0x40009 17732 bytes
font_04_sfnt_off000419b3.bin
c6568b85a6e2e218026ca03637418856909528b43400655ae82776684164b296		 pdf-font-stream PDF embedded font (sfnt) at offset 0x419B3 11688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.