Malicious PDF — malware analysis report

Static analysis result for SHA-256 95823dd1138a07f2…

MALICIOUS

PDF

66.6 KB Created: 2021-02-18 17:45:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 9ce6f30e5282ab9f2e348284583033f3 SHA-1: 6f39e5b5d4070878e92ff35ac71d11ac9da8ad45 SHA-256: 95823dd1138a07f2d9a7679bce25e3270ed8dbf7d5efffa1ee3f8aa07f76da26
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The document body, though heavily obfuscated, appears to be related to medical information, likely a lure. The presence of an external URI suggests an attempt to redirect the user to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7773

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=what+is+ac+joint+osteoarthritis PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4410027/normal_6009793b5a182.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4447278/normal_5fc72f473d7f3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408878/normal_600a4322d5f64.pdfIn PDF document text
    • http://biggymstoe.com/fezexinean333.pdfIn PDF document text
    • http://lnstagram-help-businesss.com/18676411236fcqgt.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4468551/normal_60040e977bcea.pdfIn PDF document text
    • https://cdn.sqhk.co/sixitigoxeto/V5Wgjhh/tevezo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489429/normal_5fe849cbdf850.pdfIn PDF document text
    • https://zutomivopisi.weebly.com/uploads/1/3/6/0/136051870/33cb11417e7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475588/normal_601720e3b78d9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pibabopuduj/24572836080.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f21c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF21C 4732 bytes
SHA-256: 1163802d352b842ba953fac8996492f190891bcbfa0f8ecafbc898934b8683ea

Open this report in the interactive analyzer, or submit your own file for analysis.