Malicious PDF — malware analysis report

Static analysis result for SHA-256 0091993ef582b79d…

MALICIOUS

PDF

81.2 KB Created: 2021-03-19 19:11:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50b3bf7c5b3fa641895e336dda59fffb SHA-1: 90fe9b12c4b5ea68c19c2927ee67082b76e6ef62 SHA-256: 0091993ef582b79dfa990f52bdf1ad179d04e86785314a4a53df0b7acf93b61d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that directs users to a suspicious domain, likely for credential harvesting or malware delivery. No scripts were extracted, but the presence of the malicious URL and the detection signatures indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9950

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=canton+middle+school+my+perfect+landing
    • http://milixowegamu.22web.org/90189519675.pdf
    • https://tedipoji.weebly.com/uploads/1/3/1/4/131408178/bakogibuzumo.pdf
    • https://cdn-cms.f-static.net/uploads/4455907/normal_60252df55e127.pdf
    • https://panebafizi.weebly.com/uploads/1/3/4/3/134365464/jonovin.pdf
    • https://cdn-cms.f-static.net/uploads/4421352/normal_602f95c6a5267.pdf
    • https://cdn-cms.f-static.net/uploads/4369655/normal_5fe8436096bfb.pdf
    • https://vukuwapebu.weebly.com/uploads/1/3/5/3/135310377/nipavejajiwijeni.pdf
    • https://cdn-cms.f-static.net/uploads/4414678/normal_6020a2863de10.pdf
    • http://tigexesuni.22web.org/mississippi_aphasia_test.pdf
    • https://vejupurujiku.weebly.com/uploads/1/3/1/6/131606174/1814022.pdf
    • https://cdn-cms.f-static.net/uploads/4372360/normal_604ae7f5b90d4.pdf
    • https://tukuboxux.weebly.com/uploads/1/3/4/5/134510407/7231009.pdf
    • http://maxonona.22web.org/asus_h110m-a_m.2_cpu_support_list.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://numivonef.rf.gd/kisokijujupuxi.pdf
    • https://uploads.strikinglycdn.com/files/2f25c8df-29c2-481f-b000-342219080da5/81658157064.pdf
    • https://uploads.strikinglycdn.com/files/57fab643-3753-4932-92cd-f4af189729aa/g-shock_watch_ga-100-1a1dr.pdf
    • http://tatasuvuputo.epizy.com/bachir_gemayel_songs_free.pdf
    • https://uploads.strikinglycdn.com/files/a35f871b-43ed-46ef-b545-a0f653d67d5b/poulan_pro_service_manual.pdf
    • https://5a1138df-423b-4a5d-a7c7-36223740754e.filesusr.com/ugd/a72fa8_17d2a33071724f8cb46b0d3fbb09be64.pdf?index=true
    • http://pijularof.epizy.com/53731339452.pdf
    • http://xizegamujepe.epizy.com/79648237832.pdf
    • http://bowomufe.epizy.com/does_ring_alarm_have_an_external_siren.pdf
    • https://ebc1add8-0b9d-418e-9e4a-1e287827e933.filesusr.com/ugd/ab63e3_2b03aa7b3a4042b5a84c12775235b656.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5d0f8c06-27d1-4411-8514-8a426accb9d6/molowevugupozolevodu.pdf
    • https://a7193630-a032-4ee2-b136-33837135b76a.filesusr.com/ugd/fac845_d52b820aa4394e3e8606cb2a26506c96.pdf?index=true
    • http://foweroboxufafuv.epizy.com/estilos_de_vida_saludable_segun_la_oms.pdf
    • https://uploads.strikinglycdn.com/files/78818ecf-03a8-4407-9d48-b665837ad529/free_romance_stories_to_read_online.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f225.bin
bed4a440093745a7e11ddef1fde9934df0f260d8a9ab6fb082d938c112febcda		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF225 5484 bytes
font_01_sfnt_off000104a4.bin
c02dd188df9e24ffd82f3e10c1047e22f3f6d2df4e4bffbccda8bdca241a0bf2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104A4 10524 bytes
font_02_sfnt_off000128a7.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128A7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.