Malicious PDF — malware analysis report

Static analysis result for SHA-256 047c720285dfc640…

MALICIOUS

PDF

128.9 KB Created: 2021-04-01 11:08:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e532e210889fbcf3877c25bfd291574c SHA-1: 67069b9e07f46eb28be5b06f7a68574b2476a73b SHA-256: 047c720285dfc640c43414efc2f113cd98b36b1af0c70f248cf5d1ca88053416
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded URI that points to a URL designed to look like a search result for a downloadable PDF. This is a common lure for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or trojan delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=new+headway+beginner+4th+edition+pdf+download
    • https://cdn.sqhk.co/ziveluki/ahhPjgW/crash_car_pc_2019.pdf
    • https://static.s123-cdn-static.com/uploads/4482629/normal_5fc6a10e5943c.pdf
    • https://static.s123-cdn-static.com/uploads/4417426/normal_5fdda4ab07ea9.pdf
    • http://pirojibanenuzi.getenjoyment.net/lavender_essential_oil_uses.pdf
    • https://cdn.sqhk.co/pedidagow/iiif2gh/kofiwigusijozet.pdf
    • https://cdn-cms.f-static.net/uploads/4391896/normal_6061fba7ddd16.pdf
    • https://cdn-cms.f-static.net/uploads/4495843/normal_602f924ef0ece.pdf
    • https://static.s123-cdn-static.com/uploads/4451035/normal_5fed510b85681.pdf
    • http://xepidenad.scienceontheweb.net/beautiful_creatures_rio_2.pdf
    • https://cdn-cms.f-static.net/uploads/4366668/normal_60246a63119ac.pdf
    • https://static.s123-cdn-static.com/uploads/4485005/normal_5fec242e9e9aa.pdf
    • http://wasatosu.sportsontheweb.net/34643366317.pdf
    • http://gozimudowojuzun.mypressonline.com/pagonemiwinuminekutuju.pdf
    • https://cdn-cms.f-static.net/uploads/4365998/normal_5fdc5815514c6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://fedorahosted.org/lohit
    • http://wutejaxevewef.myartsonline.com/pasukubafupakupumezopa.pdf
    • https://9610c43f-1b2a-4a8a-b660-75aaf3908198.filesusr.com/ugd/286fb8_ebfc275662254e6091cd221d26e93dce.pdf?index=true
    • https://3d5b2cfc-74f5-4c02-8466-0d369b02955c.filesusr.com/ugd/69b86f_5d0365ca26cc449e8444e912d4fc6671.pdf?index=true
    • http://punotonaduwize.atwebpages.com/biblia_version_reina_valera_1960.pdf
    • https://ff4d9611-e7ea-45f2-85d3-f0b464ef817f.filesusr.com/ugd/48f461_4db68740808f47f79686a4bffffaf763.pdf?index=true
    • https://05491ccc-77c7-428b-9c25-74f2c6c50d4a.filesusr.com/ugd/d51d36_ea7bced2e9cd4722afa3a38851f083bb.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a12c.bin
80d093eda96bf81adda09a0a8f03ca44f2bb173411b67f2f86e2dbc1fdaffb52		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A12C 5304 bytes
font_01_sfnt_off0001b346.bin
43a217103832132b845f0291e83fa507ad028048f4cf4c90458d40c8c961db35		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B346 12900 bytes
font_02_sfnt_off0001db25.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DB25 4324 bytes
font_03_sfnt_off0001e926.bin
e486522b4ee87dd152ca0b152773d0438aac3c0e2e3acbb9069abbc7c985dcd2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E926 2780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.