Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4c1aadfc4411d5c…

MALICIOUS

PDF

68.1 KB Created: 2021-03-20 17:14:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f52361ea4e2807b6ef33b7f97177fcc0 SHA-1: 0232dba1d6fc926e11e6c3724d352a611586c4fb SHA-256: a4c1aadfc4411d5c2e7f5c91c92253ffce2fdbe2f37c004cd571b3575e91d3e5
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs, one of which is directly referenced by a heuristic rule indicating an external URI. The ML classifier and ClamAV detection strongly suggest malicious intent, likely phishing or malware delivery. The document body, though heavily obfuscated, appears to be a lure related to 'genetically modified crops'. No scripts were extracted, but the presence of multiple suspicious URLs points to a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7003

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=genetically+modified+crops+advantages+and+disadvantages+pdf
    • http://shtancircul.site/how_to_become_a_spiritual_life_coach_ukpt755.pdf
    • https://cdn-cms.f-static.net/uploads/4414353/normal_6035e5dba3866.pdf
    • http://pankreatitum.ru/nulapizadoonh.pdf
    • http://hr-insider.com/elbow_the_bones_of_you_sheet_musiclrj52.pdf
    • https://cdn-cms.f-static.net/uploads/4479675/normal_60237384b5aa9.pdf
    • https://cdn-cms.f-static.net/uploads/4370064/normal_601bb38dbbdcb.pdf
    • http://inglassrus.ru/717484451fyhuj.pdf
    • https://static.s123-cdn-static.com/uploads/4449622/normal_5ffdae2e54898.pdf
    • http://alcexpress3.xyz/72629193588mbmxx.pdf
    • https://cdn-cms.f-static.net/uploads/4452587/normal_60507583d3bd0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://63aa7d51-6c54-48cc-ac87-b710a0da19c3.filesusr.com/ugd/c8d394_0f2485e41e4c43c9acd702970c070d79.pdf?index=true
    • https://51f47fa2-20f7-4ec4-bb91-8ae4aee689b4.filesusr.com/ugd/917232_e90731fe80fe4fe0987c48a7d7298ff8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7daf3b25-3bcd-4daa-815d-f4637ffb7d8a/wujuxidanomutajosejates.pdf
    • https://d4bcd744-2348-4fe3-9006-05b2fcbd3cbd.filesusr.com/ugd/704566_1f6ca1b541304d9e97245c9aba069f86.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a141c651-02c6-4602-83ea-46cde345e93c/maytag_bravos_xl_gas_dryer_not_heating.pdf
    • https://ec75ba9f-29a7-4b73-bb51-4c951d20089f.filesusr.com/ugd/17cde0_69e9b21235554b92a07f339bcb6a655d.pdf?index=true
    • https://0c3b2bb2-3ac9-4e0e-a0b2-530a831cdf0d.filesusr.com/ugd/23193f_49b4bc914da24b748af876722ba38f2a.pdf?index=true
    • https://fe92b815-f0fe-4223-924b-659339f44b90.filesusr.com/ugd/8f64fc_3ceac78effc042659c7afc4e6a8f5b19.pdf?index=true
    • https://63c5840e-267c-49ed-94d3-fc9f9d8b9c0b.filesusr.com/ugd/8c5bc8_c95850c147334c1aa9f6b86e4d2ede3e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e48751bc-44f3-4c5c-896e-1e1673e13a39/adidas_employee_store_guest_pass_portland.pdf
    • https://dbb1fad9-9c05-458f-9e32-bc0b7f65d7ec.filesusr.com/ugd/451461_81e1ffaa1fec4cb7950e7a0d97046c26.pdf?index=true
    • https://d5f1d3db-1598-48d0-a061-764c190a6564.filesusr.com/ugd/866690_aaab5edefdeb456eb75936ec440da87d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1b257be4-5004-4a27-a15d-e142f804b4fb/11699761193.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecc1.bin
091d1190143feb47cc5ee141b1f34eb519d9b44e35542c6b9d06653485d6d1c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECC1 5456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.