PDF malware analysis — malicious · 8eb1ce5f4ebea90d

MALICIOUS

PDF

134.6 KB Created: 2020-11-20 13:42:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31

MD5: 4a08fae348d5392be35a76fcdd42b7b4 SHA-1: af2e8a09a127c62149b985c823731d5e2713d2b1 SHA-256: 8eb1ce5f4ebea90de1fa3d85e0d9152cdd96b6d728b670f331aeff6f748a8acc

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing indicating an external URI, which points to a suspicious domain. The ML classifier and ClamAV also flagged this file as malicious, specifically as a phishing trojan. The embedded URL is likely intended to redirect the user to a malicious site for further exploitation.

Machine Learning

Nyx PDF Classifier malicious score 0.9722

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/strik?utm_term=no+man%252527s+sky+manufacturing+facility+puzzles PDF link annotation
- https://cdn-cms.f-static.net/uploads/4427509/normal_5fa2edfb523c2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413227/normal_5fad4d481832e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373304/normal_5fb35e9818703.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4451927/normal_5fa35b08de56f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371010/normal_5f8a29584a4cb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366045/normal_5f878445292a2.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/5c2c4d6e-e913-4d18-970b-269cc92dce2b/cuisinart_soft_serve_ice_cream_maker_instruction_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd51e825-bdf1-4aa2-8299-5ba15fc16875/20919565330.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/db805818-e14a-4ff1-98fc-7baeac044f85/26831090118.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fe8b70d6-d133-4b95-9fe3-08cce15160d0/solitaire_chess_game_rules.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9c479928-92b4-4df4-8388-76ddc8292a26/recurve_bow_plans.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b498d8f0-3e69-4623-98b8-98cb38a87694/97015115049.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f42fd6dd-adb1-4273-8fe8-4c52fa289940/how_to_crack_photoshop_cc_2018_mac.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c056d485-d145-4f02-9366-df5b57a34ec3/broke_millennial_erin_lowry.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001fba7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1FBA7	5552 bytes
SHA-256: `85be61b66839270b6d7d9a5a46102a160052f23b8ffa4daf2e883ef9a04e92f8`

Open this report in the interactive analyzer, or submit your own file for analysis.