Malicious PDF — malware analysis report

Static analysis result for SHA-256 0854be601bb7d48d…

MALICIOUS

PDF

101.5 KB Created: 2021-05-25 19:45:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: f559833d02e0177f565920078ad95771 SHA-1: b101776ea2821f40f47cfe334b0463e055982439 SHA-256: 0854be601bb7d48d6dc1022630882926d873614cfacdbc51afc0ea33bb04c0e4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious URL, which is a common tactic for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were explicitly extracted, the presence of an external URI suggests the document is designed to redirect the user to a malicious site, likely for phishing or to download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=s+s+pandey+sociology+book+pdf+in+hindi+free+download PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4378405/normal_60682e7ea03f9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4448115/normal_5feaff3214920.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446762/normal_6063b2396ad54.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481064/normal_5fd61a10200fd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421464/normal_602ee1c25de4f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419849/normal_601db209d88cd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370273/normal_601e8b3bb59c6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378406/normal_600b35d07dfd3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369317/normal_602d01fe9b7ad.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448740/normal_606302c9c81b9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408588/normal_5ffa281aa7adf.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4467979/normal_5fefbc3d61694.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://s3.amazonaws.com/telasebisu/kriya_yoga_centre_allahabad.pdfIn PDF document text
    • https://s3.amazonaws.com/kelukakeb/4107261099.pdfIn PDF document text
    • https://s3.amazonaws.com/tufitijinexu/25514560466.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0db7c314-ff5a-4aa2-9c3a-1d288cf91836/paint.net_plugin_text_outline.pdfIn PDF document text
    • https://s3.amazonaws.com/silubebebefuju/chevy_cruze_diesel_review_consumer_reports.pdfIn PDF document text
    • https://s3.amazonaws.com/kofabube/action_crack_2018.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/444bf809-fd7d-43d6-a381-dbd5dbedf40e/tietz_textbook_of_clinical_chemistry_and_molecular_diagnostics_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000faa6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFAA6 5624 bytes
SHA-256: c7d53df8187fc112e6726f5d3b0217fb779533b35d14a841cbf4d1ee0e8fa0d1
font_01_sfnt_off00010dbd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DBD 3720 bytes
SHA-256: d5ecec3e822993868ba70e247019bcdb656a9fee58d620eb93bc70658e929280
font_02_sfnt_off00011920.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11920 11256 bytes
SHA-256: ef50cf101166ace08ae5ad82b41176d756748bf3d36ad84a2aa33305e9d1372d
font_03_sfnt_off00013f89.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13F89 16164 bytes
SHA-256: ead7fd593d7f5feef6f283420e9b55f8fa4552f107c64b0063d474dd3355abd8
font_04_sfnt_off000154a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x154A2 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333
font_05_sfnt_off000162a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x162A3 10932 bytes
SHA-256: ddf25992b0ef030456c3d9407d51effbf7c1acea2732026cc77d55bb7ccb2b6b

Open this report in the interactive analyzer, or submit your own file for analysis.