PDF malware analysis — malicious · d56ae4fe00578c1e

MALICIOUS

PDF

55.5 KB Created: 2021-05-28 00:38:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6258ff05be5f58761efe964ad36f66d4 SHA-1: 58de96812b8543500dc45e66dea921d0f090d84e SHA-256: d56ae4fe00578c1e34f3c62ad3be537d6ba2f559eb36ba8e3ba3e40ddcdd744e

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URI points to a URL that, while flagged as benign, is part of a pattern of phishing lures. The document body, though heavily obfuscated, suggests a theme related to vehicle owner lookups, which is a common pretext for phishing or credential harvesting.

Machine Learning

Nyx PDF Classifier malicious score 0.9530

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.sblending.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160abd4334f2aa---21832728387.pdf
- https://kvartira-zalog.ru/wp-content/plugins/super-forms/uploads/php/files/b0b6f5c0d65e05847e31b22b6d293022/migugitufafadifokoj.pdf
- http://asesoriagarpe.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607132804228f---58000808443.pdf
- http://aaexpansionjoint.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608fd02035e1f---10232805419.pdf
- https://agribusiness.pk/wp-content/plugins/formcraft/file-upload/server/content/files/160a0b563c4c7e---gatexuxemituzoriti.pdf
- https://nam.it/wp-content/plugins/formcraft/file-upload/server/content/files/1608a28226ecd3---7116847927.pdf
- http://www.k-24.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b00cbd448f7---vuvunogagax.pdf
- https://www.euroservicemilano.it/wp-content/plugins/formcraft/file-upload/server/content/files/16083e2a496a24---pemilixagevopav.pdf
- https://bettenbaehren.de/wp-content/plugins/formcraft/file-upload/server/content/files/16075bee805c92---72625137420.pdf
- http://dok-vo.ru/userfiles/file/josoxoborakanoka.pdf
- http://allaboutdowney.com/userimages/xekepezul.pdf
- https://www.wikiwebagency.it/wp-content/plugins/super-forms/uploads/php/files/5e4ed843424e8854306ab1c11c10945a/luzorosafibixefo.pdf
- https://veglifekc.org/wp-content/plugins/super-forms/uploads/php/files//46737053242.pdf
- https://artsketch.ru/wp-content/plugins/super-forms/uploads/php/files/436bb5c6a6606dac3ecbba139dd692fc/taxananumexu.pdf
- https://drahmetbostanci.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f0d59f1442---77500270589.pdf
- https://lllk.ru/wp-content/plugins/super-forms/uploads/php/files/1c824252ac58bf09bfb75f026f271b29/23610453257.pdf
- http://www.kidnuri.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077ad23e643a---87317820098.pdf
- http://getawaynewzealand.co.nz/wp-content/plugins/formcraft/file-upload/server/content/files/160756c1e99d82---15195051069.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://feedproxy.google.com/~r/skout/mBVl/~3/1xuhb7AK25c/uplcv?utm_term=how+to+look+up+vehicle+owner+by+license+plate
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ceee.bin` `d93b62c00cfb9a8b4846a2a3ff0f3ff090778864f6e829202dd17c630f44c92e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCEEE	5320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.