Malicious PDF — malware analysis report

Static analysis result for SHA-256 8dbf0cf3e5445f5e…

MALICIOUS

PDF

69.7 KB Created: 2021-05-19 00:13:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 12d2ff4c08af3a107232e6a88682fc89 SHA-1: fe7b3877ece615557a7f9500363447edce8ea161 SHA-256: 8dbf0cf3e5445f5e5d344a6a6adbd76bfeb434118ee5b959b99b092d0297213f
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains embedded URLs that likely lead to malicious content or phishing sites. The document body, though heavily obfuscated, suggests a lure related to 'globalization composition'. No scripts were extracted, but the presence of embedded URLs and the nature of the detection indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8334

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cms.blauraum.com/wp-content/plugins/super-forms/uploads/php/files/2ef65ccec5cebac444415f05f19379d3/93141551401.pdf
    • http://atenngo.com/admin/sites/site/documents/polofelogo.pdf
    • https://jjmassociates.com/wp-content/plugins/super-forms/uploads/php/files/20b9484e8ecd263ae15390e8a1151f11/10221827687.pdf
    • https://europeancustomtailor.com/wp-content/plugins/super-forms/uploads/php/files/db81b1fe917ca649f66ec80bb4fd8095/59849125108.pdf
    • https://divorcioconsensual.com.br/wp-content/plugins/super-forms/uploads/php/files/cb43e7623eac83d143375e74f69c9e64/29622101428.pdf
    • https://drivingschoolofnorthtexas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072f6ed28f89---64331747975.pdf
    • https://home18.ru/wp-content/plugins/super-forms/uploads/php/files/e193d5913c4961d2f36ce77edeac271c/33777148581.pdf
    • https://www.hit-education.com/wp-content/plugins/super-forms/uploads/php/files/pr80hue3sieubohkbdvapsut3d/kakuvepixepibudaja.pdf
    • https://hpx.com.ua/wp-content/plugins/super-forms/uploads/php/files/24f417397058e398763dcb6a5d6fb71b/saxijizudalo.pdf
    • https://ecoinkworld.com/wp-content/plugins/super-forms/uploads/php/files/4dcba224fc61db8a6ca91e59acdeb58e/14628801023.pdf
    • https://na-nule.ru/wp-content/plugins/super-forms/uploads/php/files/7ma51f1b2j0kd62pc6jgvsurl4/gakaronupom.pdf
    • https://inlandautorepairmurrietaca.com/wp-content/plugins/super-forms/uploads/php/files/05211a3aafe314e4d55265f6fc79071e/62761712464.pdf
    • https://www.clubmanizales.com.co/wp-content/plugins/formcraft/file-upload/server/content/files/16079163fa33de---tatunupojukesepogox.pdf
    • http://ipjanah.ir/wp-content/plugins/super-forms/uploads/php/files/3t9sqidgsgve1tp0na25kk6lo1/49461185084.pdf
    • https://www.pal-kont.hu/wp-content/plugins/super-forms/uploads/php/files/109720daca90c617b74e0322dafa8aa1/69528342022.pdf
    • http://work4shop.cz/userfiles/file/bivuxezutib.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=les+territoires+dans+la+mondialisation+composition
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010800.bin
f3219f99e8f67886f0217419c5e76851655ee8576134997a5ee73774e3088cf4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10800 5160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.