Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8e44e09417606bf…

MALICIOUS

PDF

66.2 KB Created: 2021-02-09 12:02:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: dd85e8e9755877116f063eb5eae215da SHA-1: 36b385392da179cb0b20689f666d716d13cd7013 SHA-256: d8e44e09417606bfbc966d4d1460cb96b0a61863ac2552f73552d88d2cba2cf5
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9493

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/aws?utm_term=chopin+etude+13+sheet+music PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4382629/normal_600157bf397c9.pdfIn PDF document text
    • http://maxist.ru/judejupoatbo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426556/normal_6020fb79022ea.pdfIn PDF document text
    • http://fisuruwibowin.66ghz.com/come_together_chemical_bonding_quiz_answers.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4448549/normal_5fddea35322a6.pdfIn PDF document text
    • https://poburazaz.weebly.com/uploads/1/3/5/9/135993358/9592264.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4475989/normal_5fed9d8686118.pdfIn PDF document text
    • https://ximepovefuvaxoj.weebly.com/uploads/1/3/1/8/131856443/9443026.pdfIn PDF document text
    • https://cdn.sqhk.co/zisujidixa/Siic23R/mindustry_mods_github_list.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4500183/normal_5fc56fa930279.pdfIn PDF document text
    • https://cdn.sqhk.co/xubuguxovim/TjaIfhh/70131654252.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://gumigojozupe.epizy.com/53209024589.pdfIn PDF document text
    • http://ropurudowilume.rf.gd/seagate_crystal_report_9._0_free.pdfIn PDF document text
    • http://givaneja.rf.gd/calendrier_annuel_2019_format_word.pdfIn PDF document text
    • http://xevorerokune.epizy.com/snagit_video_capture_free.pdfIn PDF document text
    • http://jubuzixabes.rf.gd/british_sports_channels_tv_guide.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD6C2 5096 bytes
SHA-256: b332a40e7872bd06b68f3074be7be03fa0dd029c04dada89d8578183dd1fab04
font_01_sfnt_off0000e7ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE7EE 2060 bytes
SHA-256: bbe62571d967bdb1411a5e35c3e1558c665c432f259f41461023933dda876a1c

Open this report in the interactive analyzer, or submit your own file for analysis.