Malicious PDF — malware analysis report

Static analysis result for SHA-256 d86f3c05b580f89f…

MALICIOUS

PDF

65.6 KB Created: 2020-12-07 02:27:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 730be8dff53ddca7943d70b09055837c SHA-1: a6dc8f25744dc554ba85ea690264e6183ed0699b SHA-256: d86f3c05b580f89f8e2d301de744d3312c820f165cee938234c2e56dbecb777a
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8278

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/strik?utm_term=owsley+county+kentucky+map PDF link annotation
    • https://nubojubixuxo.weebly.com/uploads/1/3/1/4/131410311/3268326.pdfIn PDF document text
    • https://riwitasaroxaga.weebly.com/uploads/1/3/4/6/134656256/a7db828e35ed.pdfIn PDF document text
    • https://jawowigo.weebly.com/uploads/1/3/0/7/130774982/ead64c6e.pdfIn PDF document text
    • https://pojutawetuje.weebly.com/uploads/1/3/1/3/131382470/4623168.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tazibabebamep/architecture_in_ancient_egypt.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/548aa00e-9e75-44ad-bcb6-b1cc35c63573/this_server_is_blacklisted._refusing_to_connect.pdfIn PDF document text
    • https://s3.amazonaws.com/penale/slatehouse_property_management_pa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ece7e40-9ff0-4cfb-8162-6e443b8ab8e7/aerotek_employment_background_check.pdfIn PDF document text
    • https://s3.amazonaws.com/pasawe/colored_acetate_sheets_michaels.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a989859-9fbd-402c-9ddd-8ad77d217110/44821977339.pdfIn PDF document text
    • https://s3.amazonaws.com/wupagivoz/spotify_apk_ios_free.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4efdf8cdb769c6d9383f/1606373118523/expert_gardener_weed_and_feed_label.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc657d6bdb33045eee7419e/t/5fc7f0dc21d0b76f10720dd6/1606938844990/pocket_tanks_2._4._3_mod_apk.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f120.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF120 5268 bytes
SHA-256: 50588421f906526b3bfe6e530e3864bae3889ae6c9d399935d91ba0323013720

Open this report in the interactive analyzer, or submit your own file for analysis.