Malicious PDF — malware analysis report

Static analysis result for SHA-256 a453482be201e399…

MALICIOUS

PDF

70.9 KB Created: 2021-03-23 08:52:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a1d0bab33293a90854a0633ee31cb57e SHA-1: 8ea90f85af7d44a648339f3704d6879a3ebba4f4 SHA-256: a453482be201e39946eab62dde1353d8a026c1a7da8f502afbc91f93540f0b83
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is malicious and a phishing attempt. It embeds a URL that leads to a domain associated with malware distribution, suggesting it's part of a phishing campaign. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8769

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=karakteristik+aspergillus+niger+pdf
    • https://cdn-cms.f-static.net/uploads/4527345/normal_6025ee94b37d4.pdf
    • http://deladinabixek.sportsontheweb.net/plague_inc_evolved_mod_apk_android.pdf
    • https://cdn-cms.f-static.net/uploads/4486963/normal_5fd39b8096e7c.pdf
    • http://selozufuwadapuw.66ghz.com/hybridization_definition.pdf
    • http://zixaxagewan.mypressonline.com/aurora_rising_espaol.pdf
    • https://cdn-cms.f-static.net/uploads/4450259/normal_6050fe4ca6f65.pdf
    • http://boxulipibad.iblogger.org/26235903978.pdf
    • https://cdn-cms.f-static.net/uploads/4449402/normal_60318cb6a7688.pdf
    • http://rijexofugovu.medianewsonline.com/97305353213.pdf
    • http://zozamowewideno.mypressonline.com/59294441945.pdf
    • http://dazavaluk.mygamesonline.org/reglage_carburateur.pdf
    • http://kozidozilujivox.getenjoyment.net/cooking_oil_formula.pdf
    • https://static.s123-cdn-static.com/uploads/4369502/normal_5ff5ea29412ee.pdf
    • https://kojazuzok.weebly.com/uploads/1/3/1/4/131438397/9407832.pdf
    • https://tugalebuwe.weebly.com/uploads/1/3/4/0/134012885/b4aef98243a3cd.pdf
    • https://xoxilorimisutoz.weebly.com/uploads/1/3/4/7/134705863/xukosijosixubop_wazef_nekojetij_pitep.pdf
    • https://safubijob.weebly.com/uploads/1/3/2/6/132682970/noxodidibutil.pdf
    • http://roralukomoko.22web.org/pdf_split_and_merge_tool_download.pdf
    • http://suzupuwejal.mygamesonline.org/92837048926.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://3745348a-78a0-42d7-8ff4-af2b45bf5faf.filesusr.com/ugd/02631b_969292dac9664c0f819fe9ef05db4c47.pdf?index=true
    • http://muxovunibo.epizy.com/how_should_you_transport_a_grandfather_clock.pdf
    • http://fepasike.epizy.com/28460065561.pdf
    • https://6b5d12f1-3bbc-48af-9ddb-5430d2fe15e7.filesusr.com/ugd/3bf302_128ea3e23c274446a6b1e07d857868bf.pdf?index=true
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b9c.bin
e41361bde8ed97734162af065b8d7e7fa8c9b957580390f198e186e9e9643bcd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B9C 5240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.