PDF malware analysis — malicious · c2a15257cd363f93

MALICIOUS

PDF

69.6 KB Created: 2021-01-06 05:27:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6a8552a5b3952a252f13fce2e81437ba SHA-1: 2752a0e29398897f574451ca5312131274a1a302 SHA-256: c2a15257cd363f93a22f6ff70c202fc9c72c0850d114198c9913496940d9869c

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URL that directs users to a site seemingly related to movie songs, likely a lure. The presence of multiple external URLs suggests a phishing or credential harvesting attempt, possibly involving the download of further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.8149

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/aws?utm_term=baahubali+2+tamil+movie+songs+320kbps
- https://cdn.sqhk.co/rawerusiwala/LGCtfjd/minesweeper_rules_explained.pdf
- https://cdn-cms.f-static.net/uploads/4453550/normal_5fb97bdce89e8.pdf
- https://cdn.sqhk.co/mozopojugode/jaOhaih/patoratufigupobegalejiw.pdf
- https://cdn-cms.f-static.net/uploads/4447662/normal_5f9f9b7f91e4e.pdf
- https://cdn-cms.f-static.net/uploads/4411511/normal_5fc2867fa80f1.pdf
- https://cdn-cms.f-static.net/uploads/4472208/normal_5fa75560c4e6e.pdf
- https://cdn-cms.f-static.net/uploads/4426263/normal_5f9826fab0b0b.pdf
- https://cdn.sqhk.co/vowibesep/hhgiehb/ufc_254_khabib_vs_gaethje_predictions.pdf
- https://static.s123-cdn-static.com/uploads/4466366/normal_5fc837212216e.pdf
- https://cdn-cms.f-static.net/uploads/4368745/normal_5f923a481aa63.pdf
- https://cdn-cms.f-static.net/uploads/4496013/normal_5fbbfa6eeda14.pdf
- https://cdn.sqhk.co/xanodujijefu/iiggeid/36368265117.pdf
- https://cdn.sqhk.co/vutexexukus/gdKWnjs/telemundo_novelas_cennet_capitulo_33.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e824.bin` `b33cf30736743cfda5558cf9e58c72263f3f6300380786def08f906fcac489fb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE824	5888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.