PDF malware analysis — malicious · ea6fadaf046e81a8

MALICIOUS

PDF

61.3 KB Created: 2021-04-29 16:31:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 2a2082cef1c49344ac22371fd018fb6c SHA-1: 43406711a47eac587cb8918aeff999602d4eabb1 SHA-256: ea6fadaf046e81a83d74d846cc17d4614308baab8f40d603e966bb6315a6eb94

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file is identified as malicious by multiple heuristics and a machine learning classifier, with ClamAV specifically flagging it as Pdf.Phishing.Trojan. The embedded URLs point to potentially malicious PDF files hosted on compromised websites, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains references to a UPS manual, likely a lure to entice users to download the malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.8841

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://drivingschoolofnorthtexas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16076a941a32dc---jibekusetafeduvineja.pdf
- https://www.themeshcowork.com/wp-content/plugins/super-forms/uploads/php/files/049c70adaa81122e2a619b037ecf0bf9/88407132606.pdf
- http://pericosrentcar.com.mx/wp-content/plugins/formcraft/file-upload/server/content/files/1607bebd430241---16335732678.pdf
- https://www.drserapkagan.com/wp-content/plugins/super-forms/uploads/php/files/sfee0eub10908fejkjmabpe2qn/90381474079.pdf
- https://garyjetcenter.com/wp-content/plugins/super-forms/uploads/php/files/4a537288ab08c6d47ffc39e67000c206/zajagiridegagavapugojezir.pdf
- https://pankalconstructora.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073a1801e019---57589909016.pdf
- https://www.denisonlandscaping.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607044cd9cc07---87023323607.pdf
- https://sgpropertylawyers.com/wp-content/plugins/super-forms/uploads/php/files/6bba052af9fd80c696ca31b912a50304/78929319345.pdf
- https://ecef-groupe.com/wp-content/plugins/super-forms/uploads/php/files/gl35hn81d3efp4d47h3bvt6th2/warew.pdf
- https://webfox.net.au/wp-content/plugins/super-forms/uploads/php/files/f0b8b70d0fcae06f9e5829608b169fb2/bagumuwuvub.pdf
- http://www.alexgis.com/siteuploads/editorimg/file/zesovi.pdf
- http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/1606cc5dba9fb3---gikat.pdf
- http://mesotects.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c27561526e---kijawasuxewuw.pdf
- https://pensiuneavlasin.ro/wp-content/plugins/super-forms/uploads/php/files/hobleqmbtemudu2m1vh14flcbq/64707239429.pdf
- https://mrmusicfoundation.org/wp-content/plugins/super-forms/uploads/php/files/l6m3bodpoh1pimetpuvluejhfn/24282357011.pdf
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072ef4931816---38791337645.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=cyberpower+ups+825va+manual
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e5fd.bin` `5603eeaa3c3e128c43dd2d1f816ccc20f2016b746f2654eef1ec57cf26a570a1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE5FD	5716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.