Malicious PDF — malware analysis report

Static analysis result for SHA-256 012dc44da9f24fdd…

MALICIOUS

PDF

79.4 KB Created: 2021-03-16 11:19:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 92182c9b5efbe75a2e4e6a8c7b746f4b SHA-1: 12723eea7479da445534407f7dcc6065a91470a9 SHA-256: 012dc44da9f24fdda0ec4c4846b80d5966249bccf1bf6aec5752ce351427f522
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=ap+psychology+unit+6+practice+test+answers PDF link annotation
    • https://cdn.sqhk.co/vamunidibu/djghiWU/bot_designer_for_discord_online.pdfIn PDF document text
    • http://13millions-warzone.store/human_clinical_trials_pros_and_conslgmit.pdfIn PDF document text
    • https://cdn.sqhk.co/fowipovoji/boVrMiZ/95110701094.pdfIn PDF document text
    • https://cdn.sqhk.co/kofuvufexo/hVhjhcJ/the_curse_of_the_mushroom_king.pdfIn PDF document text
    • https://cdn.sqhk.co/dawadetugas/j1mgekJ/kansas_gas_service_deposit_charge.pdfIn PDF document text
    • https://cdn.sqhk.co/turomixo/ae61gh1/zumonobe.pdfIn PDF document text
    • https://cdn.sqhk.co/tedigedubemi/OWDjgyp/dj_horn_competition_song_download.pdfIn PDF document text
    • https://cdn.sqhk.co/bodegife/PNzqiiv/797862698.pdfIn PDF document text
    • https://cdn.sqhk.co/pigevikuwi/jGNW7jh/mivituzikodino.pdfIn PDF document text
    • https://cdn.sqhk.co/xenumobavun/ihggbIN/71293223844.pdfIn PDF document text
    • http://detonic-italy.website/lg_lfx28968st_fresh_air_filterof53n.pdfIn PDF document text
    • https://cdn.sqhk.co/rufebumu/jhMxyMS/ezyreg_payment_reference_number.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zozuxukoxo/what_hormones_are_affected_by_hypothyroidism.pdfIn PDF document text
    • http://vomogowejupilu.rf.gd/23744144598.pdfIn PDF document text
    • https://s3.amazonaws.com/pewibim/56659558218.pdfIn PDF document text
    • http://runezejukasik.epizy.com/garade.pdfIn PDF document text
    • https://s3.amazonaws.com/gedesisumi/67935574421.pdfIn PDF document text
    • https://s3.amazonaws.com/dabatisew/jonokesijiburowaniru.pdfIn PDF document text
    • https://s3.amazonaws.com/warapagefasovi/71885508921.pdfIn PDF document text
    • https://s3.amazonaws.com/fifuto/628121172.pdfIn PDF document text
    • https://s3.amazonaws.com/loxopudizus/macbeth_reading_guide_answers.pdfIn PDF document text
    • http://dopapaxejoj.epizy.com/repulsor_executioner_data_sheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4EC 5532 bytes
SHA-256: e645d0d53ea8167e3a2e8e54b6b0896a4a5deaa1a9cc1db1d86f89ef7cd68f2c
font_01_sfnt_off000107d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107D5 11876 bytes
SHA-256: 77973ca0e31346ca116aa481d6171ac91b4449bb31395f6a7dc4696c92684d6a

Open this report in the interactive analyzer, or submit your own file for analysis.