PDF malware analysis — malicious · 9487c8f57508e63c

MALICIOUS

PDF

61.6 KB Created: 2021-05-17 21:43:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 60889b3b0add96ffaee09d373fc1d614 SHA-1: 15eca539defd3075d84319c94bda1264486a5d8e SHA-256: 9487c8f57508e63c8e399104fdad63fd2c9c5a2226aa9aa9de48003e96b6cbbf

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as a malicious PDF by ClamAV and an ML classifier. It contains numerous embedded URLs pointing to potentially malicious PDF files, suggesting it is part of a phishing campaign. The document body, though heavily obfuscated, appears to be a lure related to car maintenance information, likely intended to trick users into downloading the embedded malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.8151

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.victorian-manor.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1609ec50916452---saxituleforuwubukoxubaxa.pdf
- http://steclotildehorton.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16075af58cfcef---35229540561.pdf
- http://vmkmsz.hu/userfiles/file/44968160618.pdf
- https://pluckywize.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609ba4ba1eff2---musug.pdf
- https://plumcourse.com/wp-content/plugins/super-forms/uploads/php/files/88d3de3dc844c338ce2c109b4006a2ca/10936220118.pdf
- https://canvasations.com/wp-content/plugins/super-forms/uploads/php/files/1uvs2qqnnmve97ib5e87vcioi5/50242826516.pdf
- https://www.sacproblemleri.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d22a497219---lolaterevuj.pdf
- http://fortlauderdalelimorental.net/wp-content/plugins/formcraft/file-upload/server/content/files/16078c6af2e83d---mumebopagivotejeji.pdf
- http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/sruhd1a3efdf86bm7jb1s7k7b0/41879973539.pdf
- https://brokenspoke.com/wp-content/plugins/super-forms/uploads/php/files/f6cbf2abaaa174c2739a0e48b9dce175/49046239587.pdf
- http://ovartec.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a144e8e0776---97044473563.pdf
- https://perleyparish.org/wp-content/plugins/super-forms/uploads/php/files/88ad0d4b316793ba18f6c6f8664ffaf3/12704163116.pdf
- https://tkpmission.org/wp-content/plugins/formcraft/file-upload/server/content/files/16091d4876a686---bugoja.pdf
- https://arizonapoolcontractor.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b8f2cce033---kebaxem.pdf
- http://www.moteco.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16084d4f44019a---kitopoxove.pdf
- https://www.d-table.com/wp-content/plugins/super-forms/uploads/php/files/88ae961a2947b8ecbecc8c735d0a5ca2/72025996386.pdf
- https://www.swissfillon.com/wp-content/plugins/super-forms/uploads/php/files/9fe2897bf32fec971e199d241a870c38/jatizeg.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=what+oil+does+a+ford+focus+2013+take
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ddf9.bin` `0acd3ebca56d7f6f890abfe40f7e148f12e01ebab2acd5ef20fb134649c27850`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDDF9	5676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.