Malicious PDF — malware analysis report

Static analysis result for SHA-256 a18a42c942c205ee…

MALICIOUS

PDF

66.6 KB Created: 2020-12-27 03:06:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: cec31139044f5f3c7e6ce1f85a1b4ea8 SHA-1: abdfe9fa5504324a0e30a433349b31359610eb80 SHA-256: a18a42c942c205eefec7826fbfb48f57d3d2699ebf8ecc199f60e6f322f5a712
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URL that directs to a suspicious domain, likely used for phishing or to download a secondary payload. The document body, though heavily obfuscated, contains text related to 'ielts answer' which serves as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7604

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=going+nowhere+fast+ielts+answer PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4484126/normal_5faa1cbaa29ad.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478123/normal_5fd67261d625c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485818/normal_5fcd0ca01697a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380858/normal_5f9a87e946292.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4464527/normal_5fc466b74dfc8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413848/normal_5fcc7bbb82aab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369640/normal_5f8da87a41f9c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418991/normal_5fd10ccd9a0ed.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380411/normal_5f95106524aef.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/36756747-0c7e-467a-9923-b3493a3849f3/jobazimode.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e1860e3-4899-45e2-a949-63da9f4a2e72/wovovudorerilebonagato.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba927485-776e-4aa4-be60-b8888486edd3/nupupaxutomenapujezip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9a11fd50-676b-487e-8480-ae7219953a88/98707537946.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD6FA 2856 bytes
SHA-256: ede077bcf9d936b2deabd1ca36e5cf164b77d75f1467ec74ab7a8d43bb048d6a
font_01_sfnt_off0000e125.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE125 5152 bytes
SHA-256: df11c4fe191106031dc5efe73c52dcbe86f815406a27051d060b07cc3df538b0

Open this report in the interactive analyzer, or submit your own file for analysis.