Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a966a51c070832a…

MALICIOUS

PDF

65.3 KB Created: 2021-04-07 06:13:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1bb99fdf1fbb88f4d52bad2c8e82f15c SHA-1: f612ca22260d230af6fa42012c908dee73e78edb SHA-256: 9a966a51c070832ad46b207a7cf1ad5df72041d67975331e834adb6ce537e848
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV specifically identifying it as a phishing trojan. While the document body is heavily obfuscated, the presence of embedded URIs and the overall detection suggest it is designed to deceive the user, likely leading to a phishing attempt or the download of further malicious content. No scripts were extracted, limiting the analysis of specific execution chains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8908

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.a1touchsolution.nl/sites/default/files/64517041799.pdf
    • https://www.viachristi.org/sites/default/files/webform/89070061484.pdf
    • https://extranet.blanchisserie-toulousaine-de-sante.com/sites/extranet.blanchisserie-toulousaine-de-sante.com/files/documents/justificatifs/pefusoxewirevujilo.pdf
    • https://www.pharoxglobal.com/sites/default/files/webform/zomufajiwadusepa.pdf
    • http://klm3fg.grhosting.cz/sites/default/files/webform/files/6948618973.pdf
    • https://www.blplegal.com/sites/default/files/webform/25596831819.pdf
    • http://cicatsalud.com/html/sites/default/files/webform/bulurifabisiwotubavigivos.pdf
    • https://ambrose.edu/sites/default/files/webform/kepasibadugemefobovabo.pdf
    • http://spotlight-sites.com/sites/default/files/webform/sizewavajifur.pdf
    • http://seiary.com/sites/default/files/webform/rec/jizexatunurometubukos.pdf
    • https://web.liderpapel.com/sites/default/files/webform/36759883892.pdf
    • https://ambrose.edu/sites/default/files/webform/sovurusogizafubeb.pdf
    • https://www.woonsocketri.org/system/temporary/webform/bogobovimefegaf.pdf
    • http://www.birdlifebotswana.org.bw/sites/default/files/webform/sightings-sketches/fipeforivu.pdf
    • https://www.blplegal.com/sites/default/files/webform/80507347088.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=manual+de+bioconstru%25C3%25A7%25C3%25A3o+pdf
    • https://campusrec.princeton.edu/system/files/webform/febapaxugodikuzakepob.pdf
    • https://www.vub.be/sites/vub/files/webform/piwolumubixu.pdf
    • https://thesanfordschool.asu.edu/sites/default/files/webform/fapivo.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f378.bin
c41ae951a2c1d7d433727c245d21e501a949beccb92c667c6a1efbe0daed0b07		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF378 5792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.