Malicious PDF — malware analysis report

Static analysis result for SHA-256 05f260a35a9e5d82…

MALICIOUS

PDF

72.5 KB Created: 2021-02-18 00:29:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: 8bafc07b20421566b5095e3f458de6bd SHA-1: 4179dfbe5218bd14ce714c5f85fbe5cc029b2c4c SHA-256: 05f260a35a9e5d823ce77e21da2fb28a954558990460abab2e878db04ad19b94
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though partially corrupted, references "Star Wars Mandalorian Season 2 Ahsoka", suggesting a lure to attract user clicks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/123?utm_term=star+wars+mandalorian+season+2+ahsoka PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4467593/normal_5fcaf906d45d3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402478/normal_5fd6f5a5a918c.pdfIn PDF document text
    • https://cdn.sqhk.co/zufuxirap/cvifgcL/ffxv_monster_arena_location.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422908/normal_6016d0a7eabd9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4456399/normal_5ff7cada434ba.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371523/normal_5feff1ac5391a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479938/normal_5ff911cd5fd7f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408598/normal_600bd4fb532be.pdfIn PDF document text
    • http://lefavapexusa.iblogger.org/executive_summary_of_a_technical_report.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404740/normal_5fd3692d86b9b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408333/normal_5fe028713571c.pdfIn PDF document text
    • https://cdn.sqhk.co/mugapowejog/ecR3Ohj/kizifewofomew.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500667/normal_600e4560b5a05.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vojapu/best_android_root_apk_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/paxuvagal/81330530541.pdfIn PDF document text
    • http://temomuduzuba.epizy.com/isopropyl_chloroformate_wiki.pdfIn PDF document text
    • https://s3.amazonaws.com/borokegujuzero/lubiradulij.pdfIn PDF document text
    • http://kolenexe.epizy.com/rilas.pdfIn PDF document text
    • https://s3.amazonaws.com/padanivozeb/two_point_hospital_traits_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de06.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE06 5456 bytes
SHA-256: ff884a3f89c69bd5c19ec6a4cdeb33b548fcf6d9a076cd313d662f6e372e918d
font_01_sfnt_off0000f076.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF076 10680 bytes
SHA-256: e1f2b376968f2a5bd420c2c1c713bec659937676a4815284cc81c170cdc1d5dc

Open this report in the interactive analyzer, or submit your own file for analysis.