Malicious PDF — malware analysis report

Static analysis result for SHA-256 9be8755c6d509a67…

MALICIOUS

PDF

53.1 KB Created: 2021-03-03 18:18:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3e2eef4f0f28d2740c2483010df04402 SHA-1: 4e781dfd18ce3c634fe6d862dd6e7826390a19d1 SHA-256: 9be8755c6d509a67effbf434261499cea7e789232c6ab10ac6ab362c07bb0119
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, appears to be a lure related to a common technical query, aiming to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8273

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=what+is+the+wps+button+on+my+xfinity+modem
    • http://revilokepudidu.mygamesonline.org/biografias_de_los_personajes_mas_importantes_de_la_independencia_de_mexico.pdf
    • http://nekuwagibajese.getenjoyment.net/for_my_legionaries_codreanu.pdf
    • http://pivojowemetobiv.mywebcommunity.org/powerblock_pro_5-50_exp_urethane_set_review.pdf
    • http://lomidal.mygamesonline.org/79307538237.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/ninasivol/53301197235.pdf
    • http://votaxikotoris.epizy.com/tablas_matematicas_de_arquimedes_caballero_para_descargar.pdf
    • https://s3.amazonaws.com/gezejoputiwinu/49996400181.pdf
    • http://zutugidod.onlinewebshop.net/kujifosobizuwapo.pdf
    • http://puzazodigeza.epizy.com/fibipomokuxabiwijezigiw.pdf
    • https://s3.amazonaws.com/xunilukegez/what_is_the_concept_of_holistic_theory.pdf
    • http://zinejamobasuwul.epizy.com/call_waiting_whatsapp_status_video.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c58c.bin
60f76836ed98ff39f9c91f0bece1da62811162470b507455cec972d26fdeff6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC58C 5568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.