Malicious PDF — malware analysis report

Static analysis result for SHA-256 021fb6192bc44905…

MALICIOUS

PDF

77.0 KB Created: 2021-04-26 20:43:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 12190ee49ffdefbf20c9cb0ce5fddf80 SHA-1: 8ac80e0b24e4766f6340189ba1bc84ee1e23a5d3 SHA-256: 021fb6192bc44905c93e95533f8b9f25d6a404456427ee1c69d5d926ae8210c5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to a service advertising an 'online excel spreadsheet password cracker', which is a common lure for phishing or malware distribution. The document body, though heavily obfuscated, contains references to wkhtmltopdf and a creation date, suggesting it was generated by a tool rather than being a legitimate document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=online+excel+spreadsheet+password+cracker
    • https://cdn.sqhk.co/madumubo/sjaNhfz/meriviwexigefo.pdf
    • http://tameeniraq.com/borobaxetasuwejezaje02t2f.pdf
    • http://siondez.ru/3537955477obpsh.pdf
    • https://cdn.sqhk.co/gupidiroka/hjjgeWY/earthworm_anatomy_lab_answer_key.pdf
    • http://kalavar.xyz/zomumowo1qyge.pdf
    • http://femokotafi.66ghz.com/64648845970.pdf
    • https://cdn.sqhk.co/mamevugixej/gthaPhh/talktok_social_app_for_making_friends_meetings.pdf
    • http://jimefat.22web.org/faxodimizir.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://koxikid.epizy.com/voxugunuxatodipur.pdf
    • https://c779a0a5-5a96-4308-8c37-720837e0bdd2.filesusr.com/ugd/4f1d02_7d3f5c3741c04d878c0b2b43c35d9745.pdf?index=true
    • https://11ab4cf5-156d-4417-99e9-5039b2a7eb5f.filesusr.com/ugd/82d61e_d14ae63082f34e07afca5714e98ae026.pdf?index=true
    • http://weralawubuzeg.epizy.com/89681195711.pdf
    • http://fadifisevak.epizy.com/numig.pdf
    • http://gejebegujisutil.rf.gd/vunurawavomeramu.pdf
    • http://mezigozogug.rf.gd/biserelarufilujuburu.pdf
    • http://mibofive.epizy.com/obc_caste_list_in_maharashtra.pdf
    • http://tiwufuwivuvuf.epizy.com/kaxogevabosinokobubuvano.pdf
    • http://zomimek.epizy.com/retexanoruriwasifa.pdf
    • http://tevokini.rf.gd/tafapejukojagumu.pdf
    • https://c9977776-9e37-4432-9eae-e541147807da.filesusr.com/ugd/bb6cc6_04b8171ca1364680a2d85fabe7f14d8c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec94.bin
188b7189c19270d6d057ed22148bad140ca015e39e492fad1fe54081d4259809		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC94 5412 bytes
font_01_sfnt_off0000ff06.bin
a80512146e15097e6ec1e1056a81fbfd0a1ae3ed9f203368c20190f924e48aa6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF06 11220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.