Malicious PDF — malware analysis report

Static analysis result for SHA-256 97cb492eb5b40a1e…

MALICIOUS

PDF

59.9 KB Created: 2021-03-09 02:36:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: de28df6be405374a563c9cc391a08ba7 SHA-1: ce325dbe8984364fa6252aa77d2ca5f0ca223ea8 SHA-256: 97cb492eb5b40a1ec376ff6422d030ba5accee8ddb38b5f33f2bd69bbc424ffa
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9570

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=bolt+standard+size+pdf PDF link annotation
    • http://organic-ita.space/11130793226xgken.pdfIn PDF document text
    • http://rerixen.scienceontheweb.net/why_has_my_steam_iron_stopped_working.pdfIn PDF document text
    • http://fisujerekuvij.getenjoyment.net/pexodimomodudor.pdfIn PDF document text
    • http://copyrightsupporthelpcenter.com/maytag_maxima_steam_washer_door_lockedvpopp.pdfIn PDF document text
    • http://libralab.digital/laxakifarcgnvt.pdfIn PDF document text
    • http://cardioactiveuficiale.site/xowepoz4pnf5.pdfIn PDF document text
    • http://poradoit1.site/9665062956q8pxs.pdfIn PDF document text
    • http://lefibipefazefep.mypressonline.com/can_blood_be_too_red.pdfIn PDF document text
    • http://eu-study.ru/discovering_computers_2020_vermaatue7vh.pdfIn PDF document text
    • http://kitukotobov.medianewsonline.com/sixuxexajorazap.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/rudelazifizuvo/55568615903.pdfIn PDF document text
    • https://37bdae34-bb2f-403f-997c-54a7c09d9c06.filesusr.com/ugd/dc98cc_74bcd76213054d28a2b07c1aeb4bbfd9.pdf?index=trueIn PDF document text
    • https://36c7e617-1221-4173-b726-d5bce2878801.filesusr.com/ugd/610d21_de83022083a14af8ac9370b2ee11b66d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jukezeluf/50221231053.pdfIn PDF document text
    • https://s3.amazonaws.com/jazamerijekufol/canciones_rock_guitarra.pdfIn PDF document text
    • http://kilarosine.atwebpages.com/what_are_some_good_workouts_for_basketball.pdfIn PDF document text
    • http://dezobod.onlinewebshop.net/what_is_the_lattice_energy.pdfIn PDF document text
    • https://s3.amazonaws.com/lolaritemukole/news_reporters_doing_fortnite_dances_meme.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d4c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD4C0 5136 bytes
SHA-256: 88077dadd47123563825e59da54b942693ba2acbd61e8431a59f0b331c1fedf6

Open this report in the interactive analyzer, or submit your own file for analysis.