PDF malware analysis — malicious · a73f8fc87c6234e4

MALICIOUS

PDF

163.3 KB Created: 2019-06-27 19:28:50 -04:00 Authoring application: PDFescape Online - https://www.pdfescape.com (via RAD PDF 3.19.2.2 - https://www.radpdf.com) First seen: 2021-05-22

MD5: 5d4ba09ef363b62d74969715c42daee2 SHA-1: 05214be487010eb87897c9e0aee4942a56df73d9 SHA-256: a73f8fc87c6234e41fe45268e2a509feafe2cd01c1074ecfee353044504473a9

64 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains multiple embedded URLs that point to suspicious domains, identified by ClamAV as Pdf.Phishing.Onedrive-9852983-0. The document body also contains these URLs, suggesting they are part of a phishing lure. The primary purpose appears to be directing users to these external sites, likely for credential harvesting or further malware delivery.

Machine Learning

Nyx PDF Classifier clean score 0.0612

Heuristics 3

ClamAV: Pdf.Phishing.Onedrive-9852983-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Onedrive-9852983-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://serengeticare.co.tz/online/OAUTH/OAUTH/box.html PDF link annotation
- https://leclix.com/1/Office/office/voicemail/index.phpIn PDF document text
- http://declinehimney.com/order%20/sheet%20/view/wallpaper/index.phpIn PDF document text
- http://everybodyeatin.com/view/order/request%20/file%20/retiovcx-excel2/In PDF document text
- http://bridgegrandfather.com/file/wallpaper/In PDF document text
- https://www.radpdf.comIn PDF document text
- https://www.radpdf.com)/Title(GenesisIn PDF document text
- https://www.pdfescape.com)/CreationDate(D:20190627192850-04In PDF document text
- http://www.dynaforms.comIn PDF document text
- https://mail.google.com/In PDF document text
- https://www.pdfescape.comIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn PDF document text
- http://www.microsoft.com/typography/fonts/default.aspxIn PDF document text
- http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn PDF document text
- http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In PDF document text
- http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn PDF document text
- http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In PDF document text
- http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn PDF document text
- http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In PDF document text
- http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In PDF document text
- http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In PDF document text
- http://www.microsoft.com/pkiops/docs/primarycps.htm0@In PDF document text
- http://www.microsoft.com/TypographyIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00000ae7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAE7	44868 bytes
SHA-256: `7ccdc54d4a5d2541bce8f1dee503ba323e5b4f52fe509013eec5ab87a8540bdc`
`font_01_sfnt_off000046a2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x46A2	6836 bytes
SHA-256: `1261aac4321ac9eb636dfa10f5af1f8454dc53b71b865c263b257bf05034b1cb`

Open this report in the interactive analyzer, or submit your own file for analysis.