Malicious PDF — malware analysis report

Static analysis result for SHA-256 006b8bac4eb3924e…

MALICIOUS

PDF

78.9 KB Created: 2021-07-16 05:57:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-05
MD5: d4b3ae7aa1431449f0b29e3c5963b5fe SHA-1: 4fb8e26c390cc4f843d35d54b150812b2a3311fc SHA-256: 006b8bac4eb3924e727d12c816edef2aecbcc9af3f58ffd62927172cf5bf1001
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF was flagged by a machine learning classifier and ClamAV as malicious, indicating it likely exploits a vulnerability to execute code. The presence of a 'download button' heuristic suggests a lure to download a secondary payload. While no scripts were extracted, the overall indicators point to a malicious document, likely used in a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/iXsW93xxTQA/square?utm_term=verb+to+be+exercises+text PDF link annotation
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f0d3febba5ad6f836fde7a/1626395647245/my_does_my_urine_smell_strong.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ee9056e9cbfe6c2fec60f9/1626247254957/39687795673.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f0a2e3801a6116008d41bf/1626383075467/jabazafivapopunodaz.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e90ebf2210ba6bce116b24/1625886399262/sudagatepojorada.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e90ebe320dbd0de2806586/1625886398782/vapepusazigapeb.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e91699c14ff043cd5c7757/1625888409450/xalumig.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e77654d31d7a3b36023603/1625781844616/99778262931.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f057a65ab2ef6cb3ecfe08/1626363815244/kowaperumiwun.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ee581de7148d06bc72a908/1626232861448/tenusuwipulopotinobore.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60eca2ce9a1cf201f807b89a/1626120910191/the_process_of_transpiration.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ee47c2df3d323292d133d7/1626228674336/neurosis_meaning_in_tamil.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f0c154de4abb1f438f88ee/1626390869097/71691501304.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ee741e114e6b7b7dea028f/1626240031077/juzaginamimoxinigosozu.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f09f181e90cb6e18327882/1626382105178/worthy_of_it_all_song.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60efee833db90d3c356f3721/1626336899347/48929356888.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ec9acb11a746407a437208/1626118859917/the_tkt_course_book.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8d6fa0cb99a3e7b659e94/1625872122234/zazokubijutafobedirogar.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f0a440854f7805a455ae0b/1626383424393/how_to_unlock_your_phone_when_you_forgot_the_password_iphone.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD1B0 10124 bytes
SHA-256: 70afc6da6eaf0484b16be89a5d65edd6b90acf3e1afc255b4529024ebb9159be
font_01_sfnt_off0000e882.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE882 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00010094.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10094 17540 bytes
SHA-256: fe4607f3b907c5b26099db5cadcd3c1cddc5cc81801dd84ef7bb8c283c96afc7

Open this report in the interactive analyzer, or submit your own file for analysis.