Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1c5d40fb3cf7f09…

MALICIOUS

PDF

84.2 KB Created: 2021-06-30 03:23:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 619ef271dbef208539e34fc7a0dbab37 SHA-1: 34d2a05f8a6432589fb225b2d2fb7c982293f11b SHA-256: e1c5d40fb3cf7f092f86dca5630088360b1a0c5b5d63c7e5d88d36d054642dfd
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a signature indicating phishing and trojan characteristics. It contains numerous embedded URLs, several of which point to PDF files hosted on potentially compromised websites, suggesting a phishing or malware distribution attempt. The presence of a link disguised as a search result for a game further supports a lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4268

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://localhomesales.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160bcabca9a296---xapobisusoxapit.pdf
    • https://jurad.eu/files/file/23261755217.pdf
    • http://associacaoguainumbi.org.br/wp/wp-content/plugins/formcraft/file-upload/server/content/files/160ac657195f5e---18677465808.pdf
    • http://grupogmec.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4ce8dec21d---80945811726.pdf
    • http://becro-plast.hr/wp-content/plugins/formcraft/file-upload/server/content/files/160add065e89d0---pokodawabazidojuwonewux.pdf
    • http://endustriyelkiralama.com/wp-content/plugins/super-forms/uploads/php/files/1skcgdd1v5gn4pvlajhdi8g5kv/bogemixofigirojab.pdf
    • http://patp1ryb.ru/media/file/98878334428.pdf
    • https://fobiy.net/wp-content/plugins/super-forms/uploads/php/files/47259c4972317467a79b62675c700961/17926409641.pdf
    • http://iideree.org/wp-content/plugins/formcraft/file-upload/server/content/files/1609402d1d7f1b---dopoziluzavowoj.pdf
    • http://cageart.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160868498a66e1---kudidagura.pdf
    • https://saleskerala.com/ckfinder/userfiles/files/42742975086.pdf
    • https://pointvirgule.ca/upload/editor/file/baperixakovibapisijixa.pdf
    • https://prsnashville.com/wp-content/plugins/super-forms/uploads/php/files/7f4de5aaa2dddec318ec06558256cca1/wamiwibiminalixejisaxad.pdf
    • http://www.megasaludips.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cb28ba6f4b8---48107818176.pdf
    • http://shukokai-voves.fr/userfiles/file/zamegojozetuvoxasabotax.pdf
    • https://kodeac.com/wp-content/plugins/super-forms/uploads/php/files/o61o98h6tvu1thlf582n56lepf/41207223373.pdf
    • https://zemiigori.com/uploads/file/kikefanixewev.pdf
    • https://www.tai.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160b096e02df3d---38626651820.pdf
    • http://www.hkwebdesign.com.hk/wp-content/plugins/formcraft/file-upload/server/content/files/160a847d2edc83---nixururew.pdf
    • https://kakvkusno26.ru/wp-content/plugins/super-forms/uploads/php/files/4d0acc56c87fab0c6c02d77f35d4615a/65698436731.pdf
    • https://expeditions-travel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606efd501e9f8---kelisul.pdf
    • https://kitapkaplama.com/upload/ckfinder/files/rodavetad.pdf
    • https://krassimirtaskov.com/userfiles/files/9435492769.pdf
    • https://feedproxy.google.com/~r/skout/mBVl/~3/GLLx1DTH0VQ/uplcv?utm_term=planet+zoo+free+download+for+android
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecf5.bin
fe8e33af05f6c22d076da12634b97a75472f827882037e776b067797e23e68f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECF5 10324 bytes
font_01_sfnt_off0001046b.bin
6c1769f63e70fbad196770e62d61f81e66d62726ead426adee5e033493828f73		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1046B 19032 bytes
font_02_sfnt_off00013483.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13483 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.