PDF malware analysis — malicious · bac4afaeafecd66e

MALICIOUS

PDF

66.4 KB Created: 2021-06-02 11:33:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: cb2c9c1da2f2350acc94052038384c18 SHA-1: 2bb6e9ad98d8b9ecd9b48a25733b019188df544a SHA-256: bac4afaeafecd66e69942bc3029ac68159667f0e6cc78ff1236cfc6df8c00fc0

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious URL, likely intended for phishing or malware distribution. Although no scripts were extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, potentially as part of a phishing campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.8460

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://chcial.ru/pbw?utm_term=sistemas+de+informacion+transaccionales+caracteristicas
- https://cdn-cms.f-static.net/uploads/4455174/normal_6053c383753f2.pdf
- https://static.s123-cdn-static.com/uploads/4451756/normal_6003d23d0c6d0.pdf
- https://cdn-cms.f-static.net/uploads/4392442/normal_60676e3721053.pdf
- https://cdn-cms.f-static.net/uploads/4470228/normal_6037253212c02.pdf
- https://cdn-cms.f-static.net/uploads/4494668/normal_5fd64967f2051.pdf
- https://cdn-cms.f-static.net/uploads/4447436/normal_600a0102d01f8.pdf
- https://static.s123-cdn-static.com/uploads/4408589/normal_5fec184948f9d.pdf
- https://cdn-cms.f-static.net/uploads/4451033/normal_600c3ce49e789.pdf
- https://static.s123-cdn-static.com/uploads/4481695/normal_5fe55f18678ab.pdf
- https://static.s123-cdn-static.com/uploads/4418556/normal_5fff5cbd2abab.pdf
- https://static.s123-cdn-static.com/uploads/4367964/normal_6004a0a16529e.pdf
- https://static.s123-cdn-static.com/uploads/4450640/normal_5febf54662c56.pdf
- https://static.s123-cdn-static.com/uploads/4424632/normal_5fe194f655c2a.pdf
- https://cdn-cms.f-static.net/uploads/4450509/normal_6058dbc28f5a1.pdf
- https://static.s123-cdn-static.com/uploads/4474222/normal_600634f85fd37.pdf
- https://cdn-cms.f-static.net/uploads/4393503/normal_6034c895c2130.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/6706856f-0bef-4049-8a3a-d3b37b4d9bdb/razemap.pdf
- https://uploads.strikinglycdn.com/files/a7bd62b8-787e-4661-9db3-a7f67471aa61/adobe_acrobat_dc_license_key_location.pdf
- https://uploads.strikinglycdn.com/files/df93df41-d068-4a70-8ed7-04a711ae5d17/48464103958.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d5b5.bin` `92817efd315336a8f03c3aab89fe236466a8eb20896ece52ca64cc50d05facbd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD5B5	5272 bytes
`font_01_sfnt_off0000e783.bin` `7be0840554229c71e905e08b398509f0dfdfe8a921809303b9a8293a40c95880`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE783	11172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.