Malicious PDF — malware analysis report

Static analysis result for SHA-256 a69ec41907950168…

MALICIOUS

PDF

71.0 KB Created: 2020-12-08 02:45:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 20bd829539e680cc45826a62f64fabeb SHA-1: 97401caa4b452944cfb4002ffff56c7968def4c1 SHA-256: a69ec41907950168fce997baad87588f4ba9051744b833e963ce53bc9dfbd6f8
64 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier clean score 0.2467

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/strik?utm_term=tangent+of+circles+worksheet PDF link annotation
    • https://panidulupeju.weebly.com/uploads/1/3/0/9/130969186/wobego.pdfIn PDF document text
    • https://jiresuzava.weebly.com/uploads/1/3/4/7/134706808/14e4da25dce.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414514/normal_5fa1605851046.pdfIn PDF document text
    • https://gozofuma.weebly.com/uploads/1/3/0/8/130874065/tuzoginamugu_gurapuluwisage_bosozelesesexe_nuxodefi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495988/normal_5fafd689a1574.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366645/normal_5f8b25ca179c2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/fd57f024-b98d-4fcd-a2e1-a131d1a43bd0/mufomatajozevomoreniza.pdfIn PDF document text
    • https://s3.amazonaws.com/gaxuremewuger/59077655163.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9eeb2266-4374-4341-a51b-ab8c9d641332/technicolor_tc8305c_specs.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e9e3bda9c57a97be47bf/t/5fc1486dbc819f1cf4077056/1606502511297/vancouver_cost_of_living.pdfIn PDF document text
    • https://s3.amazonaws.com/ginutu/manual_for_polaroid_snap_camera.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c963.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC963 5248 bytes
SHA-256: 82dbd16d546b0eda5f11d3c7b20f74055c24e63e21cc82d2ef266ead6b42e34a
font_01_sfnt_off0000db52.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB52 11516 bytes
SHA-256: 1d511c5fa3baab2971b438d601e96f273ceffd3419c1326ab6e5474f783d864e
font_02_sfnt_off000102e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102E7 16212 bytes
SHA-256: 57cf89010cd20645c9a50496ba3e8e7c4cd72f1a8a4458e60cea8e14e25e427b

Open this report in the interactive analyzer, or submit your own file for analysis.