Malicious PDF — malware analysis report

Static analysis result for SHA-256 924d75d74a29979f…

MALICIOUS

PDF

77.5 KB Created: 2021-03-31 00:53:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 50055396e51cb633b4e5f8492df54b47 SHA-1: a6784888fdef005e0a49d93dc98dc60ae7e2a7e9 SHA-256: 924d75d74a29979f92e3e3cabadbe407a8eeebcb3dfb6451194e467f7a623b9f
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, suggesting it's used to redirect users to malicious content or download further payloads. The document body, though heavily obfuscated, contains keywords related to the embedded URL, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9770

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=armour+of+god+prayer+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4374848/normal_5fdfb081b0173.pdfIn PDF document text
    • http://ranking-se.com/can_i_notarize_for_a_family_member_in_ohiowfnuu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4529087/normal_5ffb60496f52a.pdfIn PDF document text
    • http://mailedflkf.site/woxapafuzk2ii.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469370/normal_6022fed60e9a2.pdfIn PDF document text
    • http://free-at.pro/nikon_p-223_ar_rifle_scope_-_3x32mm_-_bdc_carbinewaxgk.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418178/normal_605a022a2363b.pdfIn PDF document text
    • http://sipivide.iblogger.org/55599277837.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4503617/normal_60075d71c02af.pdfIn PDF document text
    • http://acgmgroup.ru/the_maze_runner_book_5_summary9c2rj.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4402267/normal_6002ab381c80d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4491436/normal_5fe5931294b0a.pdfIn PDF document text
    • http://raisinshub.club/how_to_build_a_timeless_homeh2jxb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450631/normal_60235a4852453.pdfIn PDF document text
    • http://wetekekazovuzo.22web.org/malepogujunupa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wewiro/how_to_make_a_simple_paper_plane_that_can_fly.pdfIn PDF document text
    • http://gexipodadika.rf.gd/dezolezuzokotunuluru.pdfIn PDF document text
    • https://s3.amazonaws.com/latufenaw/94053918677.pdfIn PDF document text
    • http://gedanenek.epizy.com/bhagavad_gita_slokas_with_meaning.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012337.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12337 4892 bytes
SHA-256: 1c6e2638cc8c6d0cf841e9a65592d94f5306f53e6729e943ad20077533d67a7e

Open this report in the interactive analyzer, or submit your own file for analysis.