Malicious PDF — malware analysis report

Static analysis result for SHA-256 065773a4094096c8…

MALICIOUS

PDF

77.0 KB Created: 2021-04-25 22:22:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 854fa75e40cb5c5a5fe14ba346a1b5dc SHA-1: ef810948587518af9c148bc8bc78818af41fe258 SHA-256: 065773a4094096c8b895fd3c06b92a4a99c7f63637a182e991027f41a6f9972e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. ClamAV and ML classifiers strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though partially garbled, suggests a lure related to 'installing decals', aligning with the external URL's apparent purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=how+to+install+3m+controltac+decals
    • http://zitugaxusi.mygamesonline.org/resumen_por_capitulos_el_pequeo_vampiro.pdf
    • https://cdn.sqhk.co/vagofedewat/QpjgTYm/how_to_beat_brain_out_level_32.pdf
    • https://cdn.sqhk.co/negolura/jcjdiel/safeway_delivery_pick_up.pdf
    • https://cdn.sqhk.co/sewadokoka/ggDM4ia/star_wars_timeline_2019_mandalorian.pdf
    • https://cdn.sqhk.co/pukikojat/hS9Jhb3/fefobugodefizejemife.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/bed4397c-0a40-40ea-a184-1b64ff46ab67/91782642564.pdf
    • http://jutagejefutix.atwebpages.com/abcesso_dentrio.pdf
    • http://pogelejulogowev.rf.gd/industrial_application_of_catalyst.pdf
    • http://negikapivipen.epizy.com/21764082222.pdf
    • https://uploads.strikinglycdn.com/files/d56bf2ff-0e03-49ef-9bbf-4820e9c38919/ansys_workbench_tutorial_free_download.pdf
    • https://uploads.strikinglycdn.com/files/26061d08-dc6d-44c6-aff9-8c584fb768b8/sat_subject_score.pdf
    • https://uploads.strikinglycdn.com/files/cd1fc1f8-201b-4ad7-86df-4414dab958a2/82795741338.pdf
    • https://uploads.strikinglycdn.com/files/e8e661c3-2f69-4314-93a5-ead91d73272b/45315541351.pdf
    • http://doriponesarom.myartsonline.com/sezavebovelisesufekaxi.pdf
    • https://724418e0-3ace-43c1-abd8-628b4820fc71.filesusr.com/ugd/6df952_58a1f42ae39d436097588bd5637f59b9.pdf?index=true
    • http://firejevewonoba.rf.gd/lanibazimariziw.pdf
    • https://99470c7d-c692-4648-a7b8-36ea19db2883.filesusr.com/ugd/ab059d_43b764b3f0ed4753b2422a3c854fe7c6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a46bd227-4d48-4e4c-9291-66417c285529/44389838791.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e40a.bin
9da8cd4d027ecc8af8c3341de3481eae739022b8fa7380d3cf1a90450e996ed9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE40A 5088 bytes
font_01_sfnt_off0000f539.bin
bcc13c425e6d9ab01062dbf94d7f9ecda3bfb7130f81fc1662a3a719b8438603		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF539 10548 bytes
font_02_sfnt_off00011885.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11885 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.