Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb7518b6db953715…

MALICIOUS

PDF

75.3 KB Created: 2021-02-24 04:19:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: fcb4af6aa586c16657c56ae1e4950a9c SHA-1: c00f4a6a5a336091e9ade967b65942c5999d8676 SHA-256: bb7518b6db953715df2b1f1313ceb03ca414c6cbae874494b579b0f879edaabb
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious content. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. Although no scripts were explicitly extracted, the presence of embedded URLs and the nature of the detection suggest the document is designed to exploit user interaction, possibly through a social engineering lure related to product offers.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7884

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=tesla+model+3+performance+price+reduction PDF link annotation
    • https://cdn.sqhk.co/nalawanuxa/3r3XYbD/skyblock_minecraft_1._16._3_server.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4404490/normal_5fe5d1808649f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369323/normal_5fdd36107ef8c.pdfIn PDF document text
    • http://fb-ig-copyright.com/vizupikopoxopamimu0wgqr.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417030/normal_60053a15da64b.pdfIn PDF document text
    • https://wikifepum.weebly.com/uploads/1/3/3/9/133986434/vixafo.pdfIn PDF document text
    • https://cdn.sqhk.co/susojareb/94hhggR/magic_rampage_chapter_5_dungeon_1.pdfIn PDF document text
    • https://xutezanepone.weebly.com/uploads/1/3/3/9/133999331/betotonopezupan-pojuvibogawes-pewud-dokuwijufenizak.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://palomidifigur.epizy.com/brushing_your_teeth_worksheets_elementary.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd31.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD31 5416 bytes
SHA-256: aed1a4c5c11db80ef7bbfd1dc8c5dc3de5deb3e91a2d44c8faeb3b95c165c15e
font_01_sfnt_off00010f83.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F83 10464 bytes
SHA-256: e7b44884735d31905d41186c995102689bbf9643baa8bcf94e5f689cb2e8711a

Open this report in the interactive analyzer, or submit your own file for analysis.