Malicious PDF — malware analysis report

Static analysis result for SHA-256 992141e030c9b95d…

MALICIOUS

PDF

84.6 KB Created: 2021-04-17 04:43:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c86034965ce7b89d1a6b0ca9155a7af7 SHA-1: 7df4d64a2796f7fc8d8167abbf19709a6900ba44 SHA-256: 992141e030c9b95de7dcd9e6a847123ca0bef8b62459e7c4c2d5cc37468edcbb
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, which is indicative of a phishing or malware distribution attempt. The ClamAV heuristic also flags it as a phishing trojan. The document body, though heavily obfuscated, appears to contain keywords related to search queries, suggesting a lure to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3633

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=football+manager+2020+mobile+cheat+tactic
    • https://cdn-cms.f-static.net/uploads/4414161/normal_602fd0302567a.pdf
    • https://cdn.sqhk.co/kewebogi/jjhgha0/transformers_robots_in_disguise_combiner_force_ultra_bee.pdf
    • https://cdn.sqhk.co/sogupavetut/hhSjihb/child_custody_agreement_template_uk.pdf
    • https://napajudiweji.weebly.com/uploads/1/3/4/3/134316113/971094b86f258b.pdf
    • https://static.s123-cdn-static.com/uploads/4405903/normal_5fff4743cf8d6.pdf
    • https://cdn.sqhk.co/melipetoluf/243ggU7/82345562563.pdf
    • https://static.s123-cdn-static.com/uploads/4386849/normal_5ffecefa507b4.pdf
    • http://jesibijifinuz.mywebcommunity.org/samsung_ak59_remote_not_working.pdf
    • http://lazokiwumemo.mygamesonline.org/oxford_discover_3_workbook.pdf
    • https://ferateritilew.weebly.com/uploads/1/3/4/2/134265971/5251097.pdf
    • https://cdn-cms.f-static.net/uploads/4447250/normal_60144b8cab3aa.pdf
    • https://static.s123-cdn-static.com/uploads/4451755/normal_5fe00e3671f4e.pdf
    • https://cdn-cms.f-static.net/uploads/4472186/normal_605f9cbb763a2.pdf
    • https://cdn-cms.f-static.net/uploads/4454184/normal_601cccdc5eb2e.pdf
    • https://cdn-cms.f-static.net/uploads/4483839/normal_6039a50ad3a57.pdf
    • https://nukofagola.weebly.com/uploads/1/3/4/8/134883999/lutolexejosap-ribot-zolajemelamivuz.pdf
    • https://cdn.sqhk.co/manuguwe/giijagg/diy_popsockets_and_phone_cases_that_match.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://novosumagib.epizy.com/interior_design_portfolio_layout_templates.pdf
    • http://favuzokusom.rf.gd/answer_sheet_template.pdf
    • http://dovabaz.epizy.com/basic_russian_for_beginners.pdf
    • http://vazuvipib.rf.gd/dajiguposavogaxetapodomol.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000106db.bin
95b8098a4042feaabcbc2eb97379a5d053fb975780bc29df41deb7d226d425c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106DB 3136 bytes
font_01_sfnt_off00011207.bin
24539f2d7feabc56ea3ab8870b78e1daa06f47c61faaf3c8d23f0591726ae75c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11207 5404 bytes
font_02_sfnt_off00012445.bin
c66ca4d904078c56b82005546910036a7088999e49926505b0461c5fb16fae47		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12445 12376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.