Malicious PDF — malware analysis report

Static analysis result for SHA-256 a27ce3fce18e3ac9…

MALICIOUS

PDF

66.3 KB Created: 2021-03-24 17:17:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 95fb680070757ed821ff3339b446f551 SHA-1: c3faf2a46ed4e91e6d5ebabc8a40c70c0162336f SHA-256: a27ce3fce18e3ac9c8d8686d54ef47c035c37de955607091c6ea50f79473dbca
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI that redirects to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were explicitly extracted, the presence of embedded URLs and the nature of the heuristic firings suggest this PDF is designed to trick users into visiting a malicious site, potentially leading to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8267

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=what+are+some+good+science+fair+projects+for+3rd+graders PDF link annotation
    • https://cdn.sqhk.co/jaxubefe/hcbjbGW/top_100_most_played_games_on_steam.pdfIn PDF document text
    • http://ludshop.xyz/cambium_network_software18ns1.pdfIn PDF document text
    • http://duwelizub.mywebcommunity.org/pl_sql_iterate_over_select_result.pdfIn PDF document text
    • http://esportzmlevent.com/18411531145fit4n.pdfIn PDF document text
    • http://thecabinets.xyz/sufifarivazazonativaz2hwn.pdfIn PDF document text
    • https://cdn.sqhk.co/vapatibu/h8heiam/can_you_escape_2_walkthrough.pdfIn PDF document text
    • https://cdn.sqhk.co/zuxolusufa/2hhiahj/pidat.pdfIn PDF document text
    • http://felagem.getenjoyment.net/the_book_of_law_aleister_crowley.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/voxipanovigepiv/at_t_u_verse_channel_guide_indianapolis.pdfIn PDF document text
    • https://s3.amazonaws.com/lewuli/defensa_nacional_en_cuba.pdfIn PDF document text
    • https://s3.amazonaws.com/buganabowumujef/bat_full_form_in_commerce.pdfIn PDF document text
    • https://s3.amazonaws.com/lemefofutomapox/calendar_2019_november.pdfIn PDF document text
    • https://s3.amazonaws.com/piwanisaj/ecologia_y_derecho_ambiental.pdfIn PDF document text
    • https://s3.amazonaws.com/mexavofezoxi/manual_gps_garmin_nuvi_52_espaol.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d73f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD73F 5580 bytes
SHA-256: 4ce06fb5861c87fb9fc9eabd2631e40b4cd8d9f85344d900a9d6dee7e9639e6d
font_01_sfnt_off0000ea2d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA2D 10068 bytes
SHA-256: ec740844ea46ea584331bedeaf0e5e8f02161869f70bc29ab7902994a59714a0

Open this report in the interactive analyzer, or submit your own file for analysis.