PDF malware analysis — malicious · ce0d71cc2b6a0ff5

MALICIOUS

PDF

62.5 KB Created: 2021-05-18 01:33:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: c63fa685e0de5e19fd44a8da4138b355 SHA-1: 10ffea826a347c6a933456915ccef2b14485dd20 SHA-256: ce0d71cc2b6a0ff53f940194debee383ec0584c2856c10d5fe4c0dd7fabfb859

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a payload or redirect the user. The document body, though heavily obfuscated, suggests a lure related to downloading a PDF, aligning with a phishing or social engineering attack.

Machine Learning

Nyx PDF Classifier malicious score 0.7586

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gimoguvi.ru/strik?utm_term=livro+linguagem+corporal+no+trabalho+pdf+download PDF link annotation
- https://cdn-cms.f-static.net/uploads/4366339/normal_600e366b44db2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4456985/normal_604e4d5dd4390.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374839/normal_601f243766ef0.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4479224/normal_5ff275b0a37a9.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/fifomi/list_of_physics_formulas_spm.pdfIn PDF document text
- https://s3.amazonaws.com/jumedemimo/devoveguxosutalow.pdfIn PDF document text
- https://s3.amazonaws.com/suxiweke/jeson.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/64e565b3-0c23-46c9-8bbe-eb60607e7f65/59537720433.pdfIn PDF document text
- https://s3.amazonaws.com/xeroguru/7418796502.pdfIn PDF document text
- https://s3.amazonaws.com/wujodibu/how_many_electrons_are_in_a_4d_orbital.pdfIn PDF document text
- https://s3.amazonaws.com/juwofuxufijup/64646211518.pdfIn PDF document text
- https://s3.amazonaws.com/bezutu/insecure_is_not_a_good_show.pdfIn PDF document text
- https://s3.amazonaws.com/salosibejodod/android_app_to_add_text_to.pdfIn PDF document text
- http://zojomesadenatid.rf.gd/85013029590.pdfIn PDF document text
- http://lolufijufafoz.rf.gd/nikon_coolpix_p510_bridge_camera.pdfIn PDF document text
- https://s3.amazonaws.com/vuraradaso/wokeguzijow.pdfIn PDF document text
- https://s3.amazonaws.com/wupixufekijax/how_to_reset_my_samsung_s8_to_factory_settings.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/92f22535-eb61-4b03-b51e-ec75de980c6e/1581593656.pdfIn PDF document text
- https://s3.amazonaws.com/padosumifubobo/ninewotodirevibefog.pdfIn PDF document text
- https://s3.amazonaws.com/bakoloj/28010290085.pdfIn PDF document text
- https://s3.amazonaws.com/pobixedele/cert_of_origin_form_aj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8833b905-d586-43b1-8df6-9349687a764a/74195576026.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e8f7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE8F7	5624 bytes
SHA-256: `2efcd4757f91b97e5569182948e299a754ce87f706d7a3de92a9e47110f61448`

Open this report in the interactive analyzer, or submit your own file for analysis.