Malicious PDF — malware analysis report

Static analysis result for SHA-256 bdbe5e02c821fb4f…

MALICIOUS

PDF

70.9 KB Created: 2021-03-03 10:18:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: db7c1157fc99f8c7c7da2343c66a6d87 SHA-1: c65f8e761c93894888393a88b0002716fa636a10 SHA-256: bdbe5e02c821fb4f78e69437bda6b7edc801e6e677ebf05ec4e6f46f71dc69a0
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is malicious and a phishing attempt. It embeds a URL that mimics a search result, likely to trick users into visiting a malicious site. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a potentially harmful external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8132

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=war+of+the+worlds+tour+2019+cast
    • https://cdn.sqhk.co/joxesinejag/F5K92hb/24678945769.pdf
    • http://mewanomape.iblogger.org/sesis.pdf
    • http://xudisoda.66ghz.com/33275185195.pdf
    • https://cdn.sqhk.co/bigulikexupa/haFggSe/lelox.pdf
    • https://cdn.sqhk.co/mekaxosur/he3idOe/free_bass_booster_apps_for_pc.pdf
    • https://cdn.sqhk.co/fewoxenovof/ggTR2j4/96262796374.pdf
    • https://cdn.sqhk.co/tuseliwi/WXY8BqP/24902422954.pdf
    • https://cdn.sqhk.co/wexazaruko/dAhe62p/4511929810.pdf
    • https://cdn.sqhk.co/ravuviwidi/jfBiddl/xebanosuzegi.pdf
    • https://cdn.sqhk.co/tokotuxajif/hcoSyjd/fipobel.pdf
    • https://cdn.sqhk.co/wovenebi/Mgdgii7/prison_break_staffel_6_netflix_erscheinungsdatum_2020.pdf
    • https://cdn.sqhk.co/juxerawabuf/Fnxjdij/goal._com_uk_transfers.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gajakelegeza/3152596091.pdf
    • https://s3.amazonaws.com/sinadi/vshare_ios_no_pc.pdf
    • http://roxixelojoxas.rf.gd/63715770897.pdf
    • http://suvalomimo.atwebpages.com/10104058856.pdf
    • https://s3.amazonaws.com/dumupa/imdb_the_purge_election_year_parents_guide.pdf
    • https://s3.amazonaws.com/zarusegibitumet/ladies_football_match_reports.pdf
    • https://s3.amazonaws.com/dikomavomem/substitute_for_baking_paper_sheets.pdf
    • https://s3.amazonaws.com/pewebopufupe/balancing_word_equations_worksheet_doc.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e856.bin
78bfdfd0cecadb02e753ec4356aa703f79786cfa5c9ef3ffdb9a295083a7076e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE856 5424 bytes
font_01_sfnt_off0000fb01.bin
45b505708b520a2097cabf1e9302617eee0683eb67bc55c4558009669ce5ec11		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB01 10184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.