Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1756f0a346be1e9…

MALICIOUS

PDF

62.7 KB Created: 2021-04-02 13:10:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9a9bf4722ba4a3051b9318e42287771c SHA-1: 657194f2b50ff0f8ad17045d47ada03f5a03c888 SHA-256: d1756f0a346be1e9388c85067e40670b84bddd673de0cd077026111db8593465
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL that directs users to download another PDF. This is a common phishing lure, attempting to trick users into downloading malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9251

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=nift+syllabus+2020+pdf+download
    • https://filalodov.weebly.com/uploads/1/3/4/6/134673241/293180.pdf
    • http://particuliers-societegenerale.xyz/defofufiretevirodazuc8rn5.pdf
    • https://cdn.sqhk.co/zopizote/Ko7oHhd/real_racing_3_apk_mod_obb.pdf
    • http://taforojujutusig.mygamesonline.org/cisco_ccna_routing_and_switching_lab_manual.pdf
    • https://cdn.sqhk.co/nejisakatok/jfhfvif/royal_chaos_banquet_outfits.pdf
    • http://ogranicbio.space/how_to_use_the_color_wheel_in_photoshoplf2jr.pdf
    • https://xatuguje.weebly.com/uploads/1/3/1/8/131856293/6273627.pdf
    • https://sutopudebesi.weebly.com/uploads/1/3/1/4/131438093/sigudabamareruj.pdf
    • http://sportplays.ru/neuman_wl_social_research_methodsx5v96.pdf
    • https://jijaxiwiruba.weebly.com/uploads/1/3/5/3/135333012/sukabivigabagi_resuwemobo_pupepewizizo.pdf
    • https://valojeruxul.weebly.com/uploads/1/3/4/6/134681631/9545791.pdf
    • http://pixunune.sportsontheweb.net/58006321386.pdf
    • http://korogesubelokut.mypressonline.com/what_stocks_to_watch_on_robinhood.pdf
    • http://floradoma.net/solution_calculus_james_stewart_6th_edition6glzr.pdf
    • http://tranquils.space/5702757066h567y.pdf
    • http://com-copyrighit.com/how_to_open_seagate_external_hard_drive_xboxqbaj0.pdf
    • https://cdn.sqhk.co/bawusipa/aggYmjd/jowudufekikojosomof.pdf
    • https://cdn.sqhk.co/letarezetap/CqLhfN7/localizar_mi_android_por_gps.pdf
    • http://folugomobok.getenjoyment.net/71613532240.pdf
    • http://fikosarodone.medianewsonline.com/radio_shack_mpa-250_owners_manual.pdf
    • http://mrshadow.net/formatting_numbered_lists_in_apa75luj.pdf
    • https://cdn.sqhk.co/verexumifo/jgjVUoE/aarp_medicare_advantage_walgreens.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/44e0c547-4651-4c4a-bbed-5c184dd81609/9390635815.pdf
    • https://uploads.strikinglycdn.com/files/d1d82ed5-c647-4b55-9c00-3bae01d6b442/ganetono.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb27.bin
14e6193f1548fc44a66b6ad2eb5bdd62dfdf35a0bd291c96d39ab7ba8a7e261e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB27 5516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.