Malicious PDF — malware analysis report

Static analysis result for SHA-256 c58d52cd0bda8427…

MALICIOUS

PDF

69.3 KB Created: 2021-02-26 10:43:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: df1c1e2045491a4bce0392766f671a8c SHA-1: 0060a7c9d8564a334602b15e94a09f3946c9a08e SHA-256: c58d52cd0bda84279e57af7a92e8e2bd3263eaef4d9078afdd8eb7306467183b
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the presence of embedded URIs and the overall detection suggest the document is designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9668

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=how+to+stop+first+alert+carbon+monoxide+detector+from+beeping
    • http://xoxuvajes.mywebcommunity.org/xeron.pdf
    • https://cdn.sqhk.co/tivinarafuvu/Sghgec2/dunkleosteus_ark_the_island.pdf
    • https://mefixakiderix.weebly.com/uploads/1/3/4/3/134319494/511bdaec8fcd.pdf
    • https://mumetimobenuja.weebly.com/uploads/1/3/2/3/132302956/mabigawen.pdf
    • https://static.s123-cdn-static.com/uploads/4467593/normal_5ffa6039a53e7.pdf
    • https://cdn.sqhk.co/jedugifaxido/aiacgds/wsdot_ferry_schedule_anacortes_to_orcas.pdf
    • https://cdn-cms.f-static.net/uploads/4374703/normal_6018bbbf02f88.pdf
    • https://cdn-cms.f-static.net/uploads/4445326/normal_602400aeab161.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://watijosanowo.epizy.com/audiolivro_o_cortio.pdf
    • https://s3.amazonaws.com/wezukep/generador_automatico_de_bibliografia_formato_apa.pdf
    • https://s3.amazonaws.com/tapelu/remuledozesovunexaw.pdf
    • http://jagogapibibolin.epizy.com/small_baby_dance_whatsapp_status.pdf
    • https://s3.amazonaws.com/bulozor/tirofuwedivozanokezi.pdf
    • http://rozopujonabesix.epizy.com/beautiful_alpana_image.pdf
    • https://s3.amazonaws.com/kozibowisenatu/zogugenonidozaliwixidup.pdf
    • http://nekoraxevab.rf.gd/26024874908.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2f1.bin
02515d9f6c6d8dd1bf8efecc789309ca263c37c3973aef253f49e3cbeefba745		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2F1 5736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.