Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc09bbbf4004fafc…

MALICIOUS

PDF

76.3 KB Created: 2021-04-01 07:44:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 971aa9865be7a92db67b25fafb981269 SHA-1: 1c65015a16f016c88258329aeb61631c009c7405 SHA-256: fc09bbbf4004fafcbba0e5b4e06dd0ed89595934026c0a04c0607c06ee6bfaea
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL. The ClamAV detection and ML classifier indicate maliciousness, specifically a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to printing secured PDF files, likely to trick users into clicking the embedded URL which leads to a phishing or malware download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8947

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=hoe+kan+ik+een+beveiligd+pdf+bestand+afdrukken
    • https://cdn-cms.f-static.net/uploads/4468572/normal_602270a450705.pdf
    • http://expressvpn.store/wiat_iii_qualitative_descriptorsbdbh0.pdf
    • https://cdn.sqhk.co/jasojime/giijdgj/word_wallpapers_for_iphone.pdf
    • https://cdn-cms.f-static.net/uploads/4387819/normal_601361ca54247.pdf
    • https://fulopovesaj.weebly.com/uploads/1/3/0/7/130740112/jekagiliva.pdf
    • http://dutusejutax.22web.org/sheet_bai_hat_khuc_thuy_du.pdf
    • https://nazuvunu.weebly.com/uploads/1/3/4/4/134438845/divekipul-nilutimuf-pokipebok.pdf
    • https://cdn.sqhk.co/bularalunop/degjgat/steam_lunar_sale_2020_gifts.pdf
    • https://gikanusubidi.weebly.com/uploads/1/3/4/7/134756500/4198458.pdf
    • https://teligodinawam.weebly.com/uploads/1/3/4/4/134457670/resipe-fikat.pdf
    • http://torchland.xyz/fluval_306_canister_filter_maintenancepowh8.pdf
    • https://cdn-cms.f-static.net/uploads/4412780/normal_604632866a827.pdf
    • https://cdn-cms.f-static.net/uploads/4372955/normal_6058f85437def.pdf
    • https://zotekuruwufuk.weebly.com/uploads/1/3/4/1/134108654/1643116.pdf
    • https://cdn-cms.f-static.net/uploads/4451736/normal_5fd0a9625b80e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://faxiwig.epizy.com/action_priority_matrix.pdf
    • http://zonadomafi.rf.gd/josabosolewevululeli.pdf
    • http://kepirodineloga.epizy.com/casio_mens_g_shock_mudman_watch_g9000ms1k.pdf
    • http://wavuwiti.epizy.com/aws_ec2_documentation.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101cd.bin
c48ea2fadfe5d46239a589562a3367e7edfcf1b13539fd6bc39033e1cdc65240		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101CD 5316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.