Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7fa6a903786a136…

MALICIOUS

PDF

71.3 KB Created: 2021-03-20 09:13:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 94372eb176eed068fdf7a04f731cb49f SHA-1: 400984399fc7069cc7fb8f9ceed909aa347f628c SHA-256: c7fa6a903786a13685d2800f6e50b3bbb148213925b895cac2f5726e60791a86
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, one of which is presented as a search result for 'Asha bhosle rabindra sangeet', indicating a social engineering lure. The presence of PDF_URI and EMBEDDED_URL heuristics further supports the malicious intent of directing users to external, potentially harmful, web content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7328

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=asha+bhosle+rabindra+sangeet
    • http://votixibutiro.medianewsonline.com/housing_society_bye_laws.pdf
    • http://mirijesuwakug.sportsontheweb.net/swot_matrix_example.pdf
    • http://nakekizedexu.getenjoyment.net/sojatoxolekifat.pdf
    • https://cdn.sqhk.co/wejafivelij/iiicjgR/miwimawuxomadulu.pdf
    • http://xatovapotogu.mywebcommunity.org/90238539409.pdf
    • https://cdn.sqhk.co/lulaxujik/cijd0jf/89199071703.pdf
    • https://cdn.sqhk.co/fupokonabat/zgeggOk/tudasowozusikaropu.pdf
    • https://cdn-cms.f-static.net/uploads/4454672/normal_602b605047f6d.pdf
    • http://fatiberekizibu.iblogger.org/truck_chassis_design.pdf
    • https://cdn.sqhk.co/kipezipilojo/jqpggc6/31725443813.pdf
    • https://cdn.sqhk.co/febenapox/6mdjfja/ziwatubufo.pdf
    • https://cdn-cms.f-static.net/uploads/4414680/normal_6042892771514.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/33262c54-25fc-469d-b9be-d704742c1187/what_intermolecular_forces_are_present_in_hcl.pdf
    • https://uploads.strikinglycdn.com/files/10fc0546-a585-42f6-ade0-9316e6e35b9c/2547358726.pdf
    • https://uploads.strikinglycdn.com/files/0b5c265f-c248-469c-b22b-b78aaaac968e/stihl_fs_130_spare_parts_list.pdf
    • http://kurerori.myartsonline.com/ice_candy_man_full_text_download.pdf
    • https://uploads.strikinglycdn.com/files/119a873d-55cf-44e2-b748-13fb0b0fc2ff/the_care_and_keeping_of_you.pdf
    • http://tafituza.rf.gd/nikon_p510_red_price_in_india.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dfde.bin
ce52fa59928fa023a4011b2a18a3f420a3b24a13f0b94bd0b3732eadfe33b592		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDFDE 5216 bytes
font_01_sfnt_off0000f191.bin
bd66ba5a2f161072403f2f452fa294472f25a5f074c6dd06ae5f88f8713b678a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF191 11764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.