Malicious PDF — malware analysis report

Static analysis result for SHA-256 056ed10d1c3f3ec7…

MALICIOUS

PDF

93.8 KB Created: 2021-04-21 01:59:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 3e79a4e508afe3452724f697ba91edf3 SHA-1: 54de6f50026a3b53f53c20baf5595e6df9014997 SHA-256: 056ed10d1c3f3ec707740e31de45fe7384ef4d9df20a666a6e417dfd93ba8dfc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a phishing or trojan threat. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, appears to reference product information, suggesting a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=chicco+keyfit+30+stroller+combo PDF link annotation
    • http://tafuxasomup.getenjoyment.net/komera.pdfIn PDF document text
    • http://xokebidukefu.getenjoyment.net/jaundice_neonatal.pdfIn PDF document text
    • http://supariwepexafat.mywebcommunity.org/tovile.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475588/normal_6057dd98e9e02.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4499635/normal_601f6889a652a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370270/normal_60507287119e5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4474734/normal_5fd97afa83f72.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451549/normal_603fbbf36da9d.pdfIn PDF document text
    • http://narewenu.22web.org/18011853958.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5f599c6-d20f-41a8-8bfe-f66c89eb7a8d/how_to_find_slope_and_y_intercept_using_two_points.pdfIn PDF document text
    • https://s3.amazonaws.com/risalenefazozo/does_microsoft_have_a_flow_chart_template.pdfIn PDF document text
    • http://nokejufesuw.atwebpages.com/business_productivity.pdfIn PDF document text
    • https://s3.amazonaws.com/gateme/wokipamuruxivotemebewolo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/52f182e6-cc21-408b-a66e-9eaeb4e573f4/naval_ships_technical_manuals.pdfIn PDF document text
    • https://s3.amazonaws.com/fezenur/90610180450.pdfIn PDF document text
    • https://s3.amazonaws.com/lomuper/coreldraw_x8_full_version_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/deb92b45-203b-460e-b7e9-7008a3269fb5/rosemount_8732_datasheet.pdfIn PDF document text
    • http://matunojusorim.epizy.com/n_e_c_ka_full_form.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6ec7964-9ee4-4237-a46c-b631f66d5e1c/lemotisofa.pdfIn PDF document text
    • https://s3.amazonaws.com/tiniruru/iberia_flight_delay_claim_form.pdfIn PDF document text
    • https://s3.amazonaws.com/bisiku/label_parts_newspaper_front_page.pdfIn PDF document text
    • https://s3.amazonaws.com/bajuse/cartoon_monkey_face_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d24e7a70-13ed-4cbe-930c-b8a85bb0c86d/31353644564.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011a72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11A72 5428 bytes
SHA-256: 2f63ad171401c35f8808a68cebefc513f4eb74582ff12af38bb576976bf67dc4
font_01_sfnt_off00012cc9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12CC9 11292 bytes
SHA-256: dbcf4e3582d78753d18e3fb3fd81df1591173796fc6b707cad2572334668a763
font_02_sfnt_off0001534d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1534D 16076 bytes
SHA-256: ceb30e69b2a1d6501fe8904d8a8466471eaa529f0958da5583c6585f97c9fab1

Open this report in the interactive analyzer, or submit your own file for analysis.