Malicious PDF — malware analysis report

Static analysis result for SHA-256 c24048e71cb60ce3…

MALICIOUS

PDF

73.2 KB Created: 2021-06-03 23:54:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b3f2caff698e5a4bf26d337fb74f904d SHA-1: df9c1436c03b4f8fb484a24ee3411f988263fa16 SHA-256: c24048e71cb60ce3441a283240f133b219871a932fc5b3c05cfb73e3d94127b0
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded PDF URI points to a URL that, while initially appearing benign, is part of a chain likely leading to a malicious payload. The document body is heavily obfuscated, preventing a clear understanding of its direct purpose beyond the embedded link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9915

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://alakharia.com/public_html/userfiles/file/gorovudadowomokogudefeku.pdf
    • https://ncfouting.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607bbd39c526b---latedexujibonenomurivusan.pdf
    • http://asupuro.com/upload/save_image/files/38471328902.pdf
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/jcojntrnuofqfcfko4de779ac0/jedogodejukerikejadur.pdf
    • http://stardentalcare.org/userfiles/file/70715666300.pdf
    • http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/160a779c725932---53058662505.pdf
    • http://www.a-fairys-choice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606e77cdcb82e---88216448478.pdf
    • http://luckyassessoria.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160958faeadc43---mipemugudememusak.pdf
    • http://visit-pune.com/userfiles/file/koxokope.pdf
    • http://herodumpsterrental.com/wp-content/plugins/super-forms/uploads/php/files/c37453b0229174038b8a636779039245/dazinakewodeb.pdf
    • https://dacinsara.ro/fckfiles/file/papasavuwafikevifosupijef.pdf
    • https://popcouncilinstitute.org/wp-content/plugins/super-forms/uploads/php/files/33d01ff5c75e37dbd7038e46b3e2661d/22249069954.pdf
    • https://banktapeunadana.com/tapeunadana/bank2/admin/userfiles/file/11857996944.pdf
    • https://wccia-vastu.com/wp-content/plugins/super-forms/uploads/php/files/a1f9079200b49c03a3f913ba88d88d8f/nabujor.pdf
    • http://www.predoisiasociatii.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1609174af5ca55---wubivobaridodugivux.pdf
    • http://www.molinoag.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082e32614d1f---batun.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=trial+xtreme+4+bike+upgrades
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d359.bin
edf517a561ed5132c6c1d5718ac6ff9d870a00e6f43a91762fd168a2279cca75		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD359 6440 bytes
font_01_sfnt_off0000e34f.bin
bdac01cf981caf318638816632f70e4e9c53d89d3ea5c3042fc980d0b59f5f10		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE34F 5252 bytes
font_02_sfnt_off0000f531.bin
4e934c02f1e8f146cbce04f05e186d902dcd3fb1a78886c117d027a08533efc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF531 11268 bytes
font_03_sfnt_off00011afd.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11AFD 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.