Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad31ff8a7fa3fcab…

MALICIOUS

PDF

67.6 KB Created: 2021-02-25 10:12:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 93bd4e2be431f9353e2ef414ff68476a SHA-1: 2c34e54ac4b0e86c9990b174b8af11e61a804916 SHA-256: ad31ff8a7fa3fcab9d5a0ba700a22115ebd2c9662906739e9b254f40a35bb5df
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains a malicious URL embedded in its metadata and body. ClamAV and an ML classifier flagged this PDF as malicious, specifically as a phishing trojan. The embedded URL likely leads to a second-stage payload or phishing page.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9697

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/aws?utm_term=magnetic+current+edward+leedskalnin+espa%25C3%25B1ol PDF link annotation
    • https://cdn.sqhk.co/noluxokeruma/gWYgcPq/home_paint_ideas_exterior.pdfIn PDF document text
    • http://best-ital.fun/50505373785f0j09.pdfIn PDF document text
    • http://drive4mclaneeffingham.com/brasart_320mg_bulafux1t.pdfIn PDF document text
    • http://zamuxodub.22web.org/96750894275.pdfIn PDF document text
    • http://profaudit32.ru/books_on_subconscious_mind6cir8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/juzowilipi/kinetic_typography_template_free_after_effects.pdfIn PDF document text
    • http://fowagamop.rf.gd/74510676541.pdfIn PDF document text
    • https://s3.amazonaws.com/guwutivupudutu/62782134894.pdfIn PDF document text
    • http://kenuzuwemonuda.epizy.com/car_logo_quiz_ppt_free.pdfIn PDF document text
    • https://s3.amazonaws.com/xupovobejanam/who_created_the_summoning_jutsu.pdfIn PDF document text
    • https://s3.amazonaws.com/livivuvuwugeb/firestore_android_kotlin.pdfIn PDF document text
    • http://delixerilebuk.epizy.com/gewuvuzifedelotitalol.pdfIn PDF document text
    • http://vajonaz.epizy.com/btc_wallet_apkpure.pdfIn PDF document text
    • http://majuditatip.rf.gd/35516529636.pdfIn PDF document text
    • https://s3.amazonaws.com/varoximu/bufibesififadamonopu.pdfIn PDF document text
    • https://s3.amazonaws.com/getizar/aoc_c24g1_24_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/ragejufa/dakazi.pdfIn PDF document text
    • http://rilijoxedu.rf.gd/kubadexitoxilon.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb24.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB24 5612 bytes
SHA-256: 57bf523ef797a1a37a3829281c64c6d81665d698ec53fddc184494ee1c4dc3ea

Open this report in the interactive analyzer, or submit your own file for analysis.