Malicious PDF — malware analysis report

Static analysis result for SHA-256 a33642381e6c2578…

MALICIOUS

PDF

69.5 KB Created: 2021-03-26 13:03:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 491522f84ecda795e64965d841f67fa3 SHA-1: bc176dc725216c5a8da7294e07dd3e3689e672f2 SHA-256: a33642381e6c2578e6855193703a5532f8b9a66fa6a1215de37aabf80ff6a02d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating the presence of external URIs and is flagged as malicious by ML classifiers and ClamAV. The embedded URL, 'https://soxebez.ru/award?keyword=maximum+allowable+blood+loss+pdf', suggests a phishing attempt to trick users into visiting a malicious site. While no scripts were explicitly extracted, the PDF structure and the nature of the embedded URL point towards a phishing or malware distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8998

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=maximum+allowable+blood+loss+pdf
    • http://tuzevijubozor.mywebcommunity.org/freckle_juice_chapter_2.pdf
    • http://virivuluk.getenjoyment.net/drinking_alcoholic_beverages.pdf
    • https://static.s123-cdn-static.com/uploads/4459177/normal_6001f705d2e30.pdf
    • https://static.s123-cdn-static.com/uploads/4377113/normal_5febd02a02869.pdf
    • http://zisezamerares.mygamesonline.org/cateterismo_vesical_unam.pdf
    • https://cdn-cms.f-static.net/uploads/4476010/normal_5fd5f4f044154.pdf
    • https://cdn-cms.f-static.net/uploads/4453900/normal_60141b518aff5.pdf
    • http://fidenenaxemol.iblogger.org/what_is_an_example_of_symbolism_in_poetry.pdf
    • https://cdn-cms.f-static.net/uploads/4501961/normal_6046b5c17a19d.pdf
    • http://towexiwi.sportsontheweb.net/29521477463.pdf
    • http://visujoj.22web.org/focusrite_2i4_2nd_gen_usb_3.0.pdf
    • https://cdn-cms.f-static.net/uploads/4428083/normal_6012299f52682.pdf
    • https://cdn-cms.f-static.net/uploads/4489733/normal_60542134ee73d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://700ceb37-22d2-47c5-9888-d858af679aee.filesusr.com/ugd/c345b0_79bd484098c5479bae78ebe4b40c5111.pdf?index=true
    • https://31c8a3d4-0132-49f1-a04f-09c79d03e01f.filesusr.com/ugd/a4da84_06d70ef7fecf4b04955de877e998c1e6.pdf?index=true
    • http://wikukodukoja.onlinewebshop.net/business_process_improvement_book.pdf
    • https://39c3e2ba-dcb8-4bc0-9ed7-0058f02c59d5.filesusr.com/ugd/fd4c29_f9026c500105423bae833649542e86d9.pdf?index=true
    • http://povumuvepu.epizy.com/wetewi.pdf
    • https://dc273c12-e125-4738-b2e6-b96bc4bd5eb7.filesusr.com/ugd/c8df25_57e0c9c7a34b4b5bbb3fe06c67cb22ec.pdf?index=true
    • https://4b002d3c-a55f-42ce-816c-238f848e88a9.filesusr.com/ugd/3398cc_852659a7a5a44cd9958b4b52434c2c44.pdf?index=true
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001039e.bin
b229e4682d308232bd238a981d636bdd3aca19bfda6fb8441e7d54edb307bfbe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1039E 5396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.