Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad1a2cb81afaa58d…

MALICIOUS

PDF

69.5 KB Created: 2021-03-27 18:59:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 269030c8ce15945eacbc265817e75d66 SHA-1: 67e6406a43405661420176ef95a8398d1d74bbdf SHA-256: ad1a2cb81afaa58d2e6c4d10d9b2ea178b509daa90da297399d3e5e1bb98ec2a
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://dugedepap.ru/award?keyword=l+adjectif+qualificatif+pdf', which is likely part of a phishing or malware distribution scheme. No scripts were extracted, but the PDF structure and embedded URI strongly suggest a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=l+adjectif+qualificatif+pdf
    • https://static.s123-cdn-static.com/uploads/4501486/normal_5fcdcc4729c40.pdf
    • https://cdn-cms.f-static.net/uploads/4471082/normal_604180d31fd50.pdf
    • http://rkconstructionsucks.com/tolojivetudkh6p.pdf
    • http://lubevos.scienceontheweb.net/bajusozejevunafol.pdf
    • https://cdn-cms.f-static.net/uploads/4452169/normal_60144715257c3.pdf
    • https://cdn-cms.f-static.net/uploads/4387933/normal_6038043a2cd8b.pdf
    • http://xagakojitogiva.getenjoyment.net/hp_officejet_pro_8600_plus_user_manual.pdf
    • https://cdn-cms.f-static.net/uploads/4471099/normal_5fd9c9c32241b.pdf
    • https://static.s123-cdn-static.com/uploads/4477373/normal_5ff5580b43128.pdf
    • http://laketofetujeso.medianewsonline.com/arm_microcontroller.pdf
    • http://expressvpn.store/download_death_tour_racing_action_gamef9zmp.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://luvabokinoleg.onlinewebshop.net/rhetorical_devices_meaning_chinese.pdf
    • http://rogofideb.onlinewebshop.net/beats_studio_wireless_headphones_noise_cancelling.pdf
    • https://uploads.strikinglycdn.com/files/42948682-4abe-4e8c-804a-fdbc6d4386da/how_not_to_pursue_a_man.pdf
    • https://uploads.strikinglycdn.com/files/ac33d3d1-b0c7-4d7f-b6f1-7f40b3982b60/3732212018.pdf
    • https://uploads.strikinglycdn.com/files/9d94dc1e-3394-4607-a01b-582cc2f4ece7/sat_writing_practice_prompts.pdf
    • https://uploads.strikinglycdn.com/files/c02fbef3-f3bb-45d5-9ab9-e9e0fd5ea412/33985216826.pdf
    • https://uploads.strikinglycdn.com/files/9887f96f-3021-4fd4-b7a4-b2ae1b893d35/zejodirodotonel.pdf
    • https://uploads.strikinglycdn.com/files/b1c9ff5a-095a-4057-9566-dada92d0ac67/dajipilemexakivex.pdf
    • https://uploads.strikinglycdn.com/files/cf65cfee-a881-423b-a5d5-98341035f87f/how_to_use_a_mophie_wireless_charging_pad.pdf
    • https://uploads.strikinglycdn.com/files/6558af80-b29d-470b-bd50-80c34ce34624/73066201886.pdf
    • https://uploads.strikinglycdn.com/files/456e50c4-8811-43a3-b280-1174680c7979/72532508154.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fcfb.bin
fc7dd4d3c608d3aa462e70b16a2f48df764fdb66ba97f52c35eea996caa491a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCFB 5020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.