Malicious PDF — malware analysis report

Static analysis result for SHA-256 0097a991c1d08639…

MALICIOUS

PDF

80.3 KB Created: 2020-12-01 12:48:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: cc67edca259ae18386918d30e8760179 SHA-1: d14a1d6735d0b83cf6519be6d4a554d4c8d78525 SHA-256: 0097a991c1d086399e8565888ca85d103c1638f06dd4714f761773ac44358251
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to a domain associated with phishing lures, disguised as a financial document. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/aws?utm_term=convertible+note+term+sheet+template PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4393761/normal_5f9a33c5d6b2e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368958/normal_5f92f58c0eebb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365639/normal_5f875a0c4108f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378848/normal_5fb8916990364.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501360/normal_5fc4a26e7338a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366660/normal_5f890e112cb33.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409395/normal_5f9996e0d21d6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368471/normal_5f9627df75945.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static1.squarespace.com/static/5fbffbf92e34347c703edab4/t/5fc24f5c3c02f22b9d583b55/1606569820591/phyzspringboard_conservation_of_energy_answer_key.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe2d1e1972c46e3c691c9b/1606298911150/pull_down_spice_rack_container_store.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7134d20b-bd86-48ca-8645-f4d7861b1973/spanish_reading_comprehension_level_3.pdfIn PDF document text
    • https://s3.amazonaws.com/viregujipowuru/rotex_pneumatic_actuator.pdfIn PDF document text
    • https://s3.amazonaws.com/lupebesu/australian_asthma_foundation_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/ruzaganog/bilegejesitinutevifojo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f494904-8fef-4148-ad7a-bd75bca455d3/3960405902.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d9c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD9C2 5068 bytes
SHA-256: 0b523325a8ec51a7769cd5c4606c793da90e034bf39b545fa4c641debeb1eac9
font_01_sfnt_off0000eac2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAC2 10948 bytes
SHA-256: 34e6cfe53cb1b7737286c328eb63316e831522b053c7be4eea3eb12a11a150cb
font_02_sfnt_off0001103d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1103D 16312 bytes
SHA-256: 975089639afea594160f6daa1ae948ffc4125994d61a9fd32dce02580f7b6b15
font_03_sfnt_off000125c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125C8 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.