Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfe8625b64d2f116…

MALICIOUS

PDF

64.0 KB Created: 2021-03-18 11:37:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fb4cbdcb4fb903f2aa543261da0310ba SHA-1: d2b4747c17e7af1580f3d5f26dd23bb09107cfc9 SHA-256: bfe8625b64d2f1164cc5a8a27f5b05d1247a18d5b766ec112eb43a752d611802
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain. Heuristic analysis and ML classification indicate malicious intent, likely phishing or malware delivery. The embedded URL is the primary indicator of compromise, suggesting the document is a lure to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9729

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=accounting+and+finance+for+non+specialists+10th+edition+pdf
    • http://raxewaponoxiv.mygamesonline.org/52824511267.pdf
    • https://cdn-cms.f-static.net/uploads/4452152/normal_6031ea55433e1.pdf
    • http://podeves.xyz/nail_shops_open_on_sunday_near_meop1nq.pdf
    • http://womirewuzakuf.sportsontheweb.net/59567918217.pdf
    • http://nunesop.scienceontheweb.net/kufetezudopobupano.pdf
    • http://mumolazesinidix.getenjoyment.net/network_security_free_download.pdf
    • http://zujiran.iblogger.org/best_early_operating_system_cyberpunk_2077.pdf
    • http://form-lnstagramverificationbadge.com/sagemcom_fst_5260cv_reviewmv5mo.pdf
    • http://christinaanddavid2019.com/74127557540c3mo2.pdf
    • https://cdn-cms.f-static.net/uploads/4392210/normal_6052dfc88555e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://6cdb29d4-22ce-4aaf-9e51-562b59d50851.filesusr.com/ugd/1b20fb_3a067a8d38e64489a625cae393c5c833.pdf?index=true
    • https://s3.amazonaws.com/muvevanepen/co_op_games_for_android_offline.pdf
    • http://pekipawoj.epizy.com/purpose_of_using_transitions_in_essay_writing.pdf
    • http://jixonolalosixew.rf.gd/podoxaziluwewu.pdf
    • http://dewudirana.epizy.com/pdf_to_word_convertor_free_software.pdf
    • https://s3.amazonaws.com/limewub/cpp_industrial_engineering_curriculum_sheet.pdf
    • https://s3.amazonaws.com/zesotat/que_es_educacion_civica_y_su_importancia.pdf
    • http://sujidise.epizy.com/dahao_embroidery_software.pdf
    • https://s3.amazonaws.com/xamibudasagas/74420578763.pdf
    • https://9afb1793-bc57-4514-bb46-74e980466609.filesusr.com/ugd/11f207_76225f82fcd4411fa195c03d4c972f7e.pdf?index=true
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f263.bin
0a17b18f9576903f224cf7d3ec24f6b0b6f966ec3eb18daea0ea6f6a87fc02a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF263 5600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.