Malicious PDF — malware analysis report

Static analysis result for SHA-256 0474ff660736c906…

MALICIOUS

PDF

221.5 KB Created: 2021-03-16 05:00:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 627ecd64956682260e85a2a734f3af3f SHA-1: 2666e0287d96fc87cc5d9efd94dbf9cedad9603a SHA-256: 0474ff660736c906a26c7d673b457bd1d95bc9283bd388d42947b6d5196fde92
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that directs users to a suspicious domain, likely for a phishing or malware distribution attempt. No scripts were extracted, but the presence of the external URI and the ML/ClamAV detections strongly indicate a phishing or credential harvesting attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=burda+shareef+pdf
    • http://flash-sar.online/62496290992vw4bt.pdf
    • http://myluckybet.xyz/is_it_worth_buying_a_coffee_grinder8uot4.pdf
    • http://montana-media.com/google_play_books_apk_freeoqtfy.pdf
    • http://perulupom.22web.org/boririkobexabaniduw.pdf
    • http://cloudplay.xyz/39624485270gp3wk.pdf
    • http://detonic-buy.website/bassinet_fitted_sheet_australiadt6t8.pdf
    • http://pafowitowa.medianewsonline.com/mortgage_amortization_formula.pdf
    • http://comforfemj.fun/what_state_has_the_highest_median_income673oz.pdf
    • http://byseles.xyz/sony_a230_untuk_videosmrv2.pdf
    • http://sputnews.com/whats_the_difference_between_analog_and_digital_channelssna0b.pdf
    • http://lanasobewusek.22web.org/cape_hatteras_fishing_report_surf.pdf
    • http://timelessdecorum.com/chupana_bhi_nahi_aata_ringtone_freey2wuk.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://ligiwekuxote.myartsonline.com/ipod_classic_5th_generation_30gb_specs.pdf
    • http://kesofater.rf.gd/77795938066.pdf
    • http://zagofij.onlinewebshop.net/bhagavata_purana_sanskrit.pdf
    • http://lavodusepigixu.rf.gd/borilegorewulejazeso.pdf
    • https://s3.amazonaws.com/fonazuzixagizir/vukusibojotu.pdf
    • http://fedetikapore.epizy.com/affairscloud_current_affairs_october_2020.pdf
    • http://girofili.myartsonline.com/fire_and_ice_poem_interpretation.pdf
    • https://s3.amazonaws.com/davolazupivowi/brother_birthday_cake_images.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00032c2a.bin
2692dd8dfcedc16ef96e42f33e7f13ff1631ee625d08438217ed8859a0be4dde
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x32C2A 35244 bytes
font_00_sfnt_off0002f217.bin
e695d2a99991c376a2cd5122970a17b9725a60ee93c85c01c36ec1466b84be4e
pdf-font-stream PDF embedded font (sfnt) at offset 0x2F217 5144 bytes
font_01_sfnt_off00030397.bin
b8eb9b6451c1c50c018a7f987a9e509c6cf7b59cafd6e922e1e48ccb63360557
pdf-font-stream PDF embedded font (sfnt) at offset 0x30397 12676 bytes