Malicious PDF — malware analysis report

Static analysis result for SHA-256 07b7e9b6342ab12c…

MALICIOUS

PDF

75.1 KB Created: 2021-05-06 22:05:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0185f5eb35f3244d7df022e2c301a706 SHA-1: ce6fc4ae86bf7d5bf30ed24dc8359819d6eba6a5 SHA-256: 07b7e9b6342ab12c4329c64eab62f18a57109df2cd73a86dfea5198007a287bd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by a ML classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a document that appears to be a lure for a "world crime index report", likely designed to trick users into downloading further malicious content. Several unknown URLs were extracted, suggesting a potential download or redirection mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ecbpolska.pl/wp-content/plugins/super-forms/uploads/php/files/707a0ea10b7c1cb75d6dd65207f02c26/riposuzapixovabo.pdf
    • https://m-co.de/wp-content/plugins/super-forms/uploads/php/files/4l3gf44nhon26agpt7hb2c5one/56905903322.pdf
    • http://bizwd.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075f57ce5191---wiputixufavat.pdf
    • https://www.booster-p.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e9f9cef0b2---43597597350.pdf
    • http://www.ausafrica.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607adf4cc6a21---niripuwewurexafoxeb.pdf
    • http://digimaap.com/wp-content/plugins/super-forms/uploads/php/files/8d8bodv1n9kof8o5ofrr10e4r3/dubademozo.pdf
    • https://maloneslandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f1b63f3f73---votomaraxobovo.pdf
    • http://aaexpansionjoint.com/wp-content/plugins/formcraft/file-upload/server/content/files/160712055ed9fe---lorixitenijerefuwatetera.pdf
    • https://sirikulsteel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607aaa6476654---77603752622.pdf
    • http://makaifruits.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ff2a9798a9---3966851011.pdf
    • http://vilaportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/160768fdb13a98---877885883.pdf
    • http://vilaportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082520bb0fde---lofusog.pdf
    • http://sh8ke.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086f94722af8---mapelenojiwedasurugali.pdf
    • http://antwerp-rentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/160922106c54b6---siruderomusovuza.pdf
    • http://protech.com.ng/wp-content/plugins/formcraft/file-upload/server/content/files/16090942e39813---88486521189.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/skout/mBVl/~3/A3Ryygt5BCM/uplcv?utm_term=world+crime+index+report
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eadb.bin
adbb62b7c7980c3be6a9d7183507fbbc8f5c764f3ebe96baa86712a6888533c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEADB 4912 bytes
font_01_sfnt_off0000fb88.bin
7a43edede9759a04d6feed24f8cd7fc015d656f0755f016c6e45e48476c914a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB88 10840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.