Malicious PDF — malware analysis report

Static analysis result for SHA-256 e70c98daa3e099f5…

MALICIOUS

PDF

69.5 KB Created: 2021-03-30 00:40:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a3a67ac034a8ffe31c2249b06a12609f SHA-1: 78274c219c6db8b41606f1809597909edfd2aeb0 SHA-256: e70c98daa3e099f5565ad935b9b0c40311b3ae177c1218bdd8a478f1f9055a38
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified by heuristics as a potential phishing lure. ClamAV detection and ML classification strongly indicate malicious intent. The document body, though heavily obfuscated, suggests a theme related to 'alphanumeric codes' and 'awards', likely a pretext to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9914

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=alphanumeric+codes+pdf
    • https://cdn-cms.f-static.net/uploads/4410414/normal_600a9b29aeeca.pdf
    • http://kixiwogazu.sportsontheweb.net/wix_add_files_to_google.pdf
    • http://about-central.com/75313527200lulb7.pdf
    • http://pro-gram.pro/bastien_piano_book_3gmboa.pdf
    • https://cdn-cms.f-static.net/uploads/4498702/normal_6013479421ff8.pdf
    • https://cdn-cms.f-static.net/uploads/4408333/normal_6039f775e4391.pdf
    • http://ellmax-site.xyz/940742939408n9ep.pdf
    • http://myimperfectmomlife.com/moninawewidijetagc0ipj.pdf
    • http://cetakchantek.com/soxibopajinorejivasiplpvkn.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1667780e-57d3-4c88-9603-b549ac708874/what_element_has_two_valence_electrons.pdf
    • https://s3.amazonaws.com/fezenur/80776218900.pdf
    • https://s3.amazonaws.com/sifawekujiki/baby_girl_party_dresses_9-12_months.pdf
    • https://s3.amazonaws.com/risalenefazozo/how_to_find_the_surface_area_of_prisms_and_cylinders.pdf
    • https://uploads.strikinglycdn.com/files/3f853797-18cd-41e8-8fcf-ba47ba42237f/mimazuvedekapofofefom.pdf
    • https://s3.amazonaws.com/fikuvine/resistors_capacitors_and_inductors_information.pdf
    • https://s3.amazonaws.com/bejokazemur/mobaxazilosimuxoveguj.pdf
    • https://s3.amazonaws.com/jevelel/pajobaxobadulexava.pdf
    • https://s3.amazonaws.com/fekaduvopigab/maxwell_s_wave_equation.pdf
    • https://s3.amazonaws.com/xupovobejanam/robuporuliwavar.pdf
    • http://lukafimagog.atwebpages.com/referencias_bibliograficas_para.pdf
    • https://s3.amazonaws.com/vonutavekip/raju_bhai_songs_telugu.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eec9.bin
02eb7cd720512007050aa24738748967f0503cb10e0f6de6c986b1b962f1c91f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEC9 5384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.