Malicious PDF — malware analysis report

Static analysis result for SHA-256 a58b817b76d828e3…

MALICIOUS

PDF

75.0 KB Created: 2021-03-25 10:46:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b68c5f984d71a039a3984ab25cb0a51e SHA-1: 7968f9c878e82fe05b7129afa419096027c07b1a SHA-256: a58b817b76d828e3f21a7086c61c80c5fc82695f4d5ff26a138c4152507b62ce
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URI pointing to a suspicious domain, flagged by heuristics as malicious and a potential phishing or trojan delivery mechanism. The document body is heavily obfuscated, but the presence of external links suggests an attempt to redirect the user to a malicious site. No scripts were extracted, but the overall structure and heuristic firings indicate a likely phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8022

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=history+of+analog+computer+pdf
    • https://cdn.sqhk.co/puwidebudojo/gegcX1C/corn_maze_adventure_near_me.pdf
    • http://tehnotop.site/how_to_determine_your_ring_size_uk3puva.pdf
    • http://copyrightsupporteds.com/dajufofamapaxewazokaras0faw.pdf
    • http://sacredname.ru/fupomatonogiwugejivnyyqi.pdf
    • http://thedefenseforge.com/creo_sheet_metal_extrudeqthd8.pdf
    • https://cdn.sqhk.co/vuwonesi/jaieTPQ/58960710919.pdf
    • https://cdn.sqhk.co/korulifesewa/it4lDhm/dessert_recipes_wheat_free.pdf
    • https://cdn.sqhk.co/wepunajexiju/jcvgdtL/jejakaputitibix.pdf
    • http://getbuiss.online/information_on_eclipses_solar_and_lunarlukts.pdf
    • http://logunesunoj.medianewsonline.com/43681983628.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/dumupa/4-shelf_tension_pole_shower_caddy_instructions.pdf
    • https://s3.amazonaws.com/nisiwanolom/57391735919.pdf
    • https://s3.amazonaws.com/gifiz/zojevenaridixoda.pdf
    • https://s3.amazonaws.com/wexoteluwag/act_science_practice_test_with_answers.pdf
    • https://uploads.strikinglycdn.com/files/b9adab92-3fac-4338-8f8c-fd7ba52efc75/25385317606.pdf
    • https://uploads.strikinglycdn.com/files/6d62c2e4-edce-4dc8-a99e-44d17b07c3f7/fejijawum.pdf
    • https://s3.amazonaws.com/febopa/ditobikipatugez.pdf
    • https://s3.amazonaws.com/baposivarabuj/mekudumaverojalelefe.pdf
    • http://xemunebo.atwebpages.com/scheda_anamnesi_palestra.pdf
    • https://uploads.strikinglycdn.com/files/ca9f0358-9144-4641-b52a-a48865c98d29/witudutetebe.pdf
    • https://uploads.strikinglycdn.com/files/63f56f31-b01c-4908-8020-07d2d7ddc109/gaxomudevasikanaxabojoxu.pdf
    • https://s3.amazonaws.com/gonasidupij/fapevarigixoduxavagujuz.pdf
    • https://s3.amazonaws.com/wunupalezozerud/color-_aid_paper_sheets.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010c8e.bin
78bfdd38e73b1c233eb1e4588d1b3d138c3364548b8fc29944367405348aec15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C8E 5536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.