Malicious PDF — malware analysis report

Static analysis result for SHA-256 af4a778d08fcd681…

MALICIOUS

PDF

72.2 KB Created: 2021-03-08 14:40:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: ca6896d796d784f0d59888b099e47668 SHA-1: 6700e5855cdbaf22da1eb903e787a236771837d5 SHA-256: af4a778d08fcd681fc02c9347f77b310ad61a5ca1fc50b4732cca1404b41e821
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8239

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=caracteristicas+linguisticas+do+texto+expositivo+argumentativo+pdf PDF link annotation
    • https://galewijukinez.weebly.com/uploads/1/3/2/6/132695540/jajebuja.pdfIn PDF document text
    • https://jenifamizoj.weebly.com/uploads/1/3/5/3/135319667/torijibigemajaf-jigut-lebiduxonuf-bamesira.pdfIn PDF document text
    • https://lizifonaw.weebly.com/uploads/1/3/2/3/132302762/1519733.pdfIn PDF document text
    • https://cdn.sqhk.co/porekige/Q2Agggi/maze_runner_book_3_common_sense_media.pdfIn PDF document text
    • https://cdn.sqhk.co/veletafi/GifVbjg/10802478563.pdfIn PDF document text
    • http://debegezuvume.iblogger.org/88494623396.pdfIn PDF document text
    • http://rometinanuk.iblogger.org/35374327153.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://rutuvofogiseba.epizy.com/28707116912.pdfIn PDF document text
    • http://visowad.epizy.com/luripexa.pdfIn PDF document text
    • http://xitemefunugege.epizy.com/gubopimubije.pdfIn PDF document text
    • http://javuturevof.rf.gd/blitzer_algebra_and_trigonometry_6th_edition_access_code.pdfIn PDF document text
    • https://s3.amazonaws.com/mukutud/xafuginogirepumip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e1166a9d-7174-4bac-a4d8-427182370f86/58556457601.pdfIn PDF document text
    • https://s3.amazonaws.com/baxunaf/carbonic_acid_formation_from_co2.pdfIn PDF document text
    • https://s3.amazonaws.com/sirilagewuga/why_is_my_belkin_portable_charger_not_working.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a9fc38b-ba55-4364-a239-17f687164d6e/pawn_of_prophecy_hardcover.pdfIn PDF document text
    • https://s3.amazonaws.com/widiku/23036650296.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001046a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1046A 5508 bytes
SHA-256: fb2106f302bc086a20dce56828c02dde45a3d0166f48078644f678844da0e4f8

Open this report in the interactive analyzer, or submit your own file for analysis.