Malicious PDF — malware analysis report

Static analysis result for SHA-256 08bca3c9e155973c…

MALICIOUS

PDF

89.4 KB Created: 2021-04-06 07:02:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a4ba071d9d7509d778838492f27d400e SHA-1: 7d8f3dd3d828b2afc67fe13b235b1624f100bcca SHA-256: 08bca3c9e155973c3c0fae80189ee4f1d7f3eabe258823e2222d65540550d3ac
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that leads to a suspicious domain, likely intended to redirect the user to a malicious site. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest an attempt to exploit user interaction, possibly through embedded JavaScript or other active content, to achieve its malicious objective.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=espacio+arquitectonico+definicion+pdf
    • https://cdn-cms.f-static.net/uploads/4379859/normal_60171b3da7cec.pdf
    • https://cdn-cms.f-static.net/uploads/4471273/normal_600f3237c3dbe.pdf
    • https://cdn-cms.f-static.net/uploads/4403271/normal_5fd6414363d38.pdf
    • https://static.s123-cdn-static.com/uploads/4418367/normal_5fe191ec4068d.pdf
    • https://cdn-cms.f-static.net/uploads/4412575/normal_604d98193ad35.pdf
    • https://cdn.sqhk.co/medujebukoma/jjghY8W/adventure_escape_mysteries_picture_perfect_chapter_8.pdf
    • https://cdn.sqhk.co/zimopaji/aihWPDo/halloween_phone_wallpaper_tumblr.pdf
    • https://cdn-cms.f-static.net/uploads/4426974/normal_60414d0414661.pdf
    • https://static.s123-cdn-static.com/uploads/4495550/normal_5ff360e705b6c.pdf
    • https://static.s123-cdn-static.com/uploads/4463532/normal_5feb78b07956f.pdf
    • https://cdn-cms.f-static.net/uploads/4378852/normal_5fd65881178a9.pdf
    • https://static.s123-cdn-static.com/uploads/4465935/normal_5fcf0c3b944a1.pdf
    • https://cdn.sqhk.co/fuvebopeweb/Zgiijgh/nisezilimiseg.pdf
    • https://static.s123-cdn-static.com/uploads/4420238/normal_5fdef347d36c3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/pogolo/how_many_seconds_does_it_take_to_fall_100_feet.pdf
    • https://uploads.strikinglycdn.com/files/779403e6-ec7d-4a74-96a0-a011a84309d4/kebomojexodikozinukewisir.pdf
    • https://s3.amazonaws.com/bupesejirijejus/what_is_australian_aboriginal_religion.pdf
    • https://uploads.strikinglycdn.com/files/b36cb542-855d-4680-8809-6ff1bc3874db/57902971976.pdf
    • https://s3.amazonaws.com/wajufifenoxuj/gusazajefovojisixojaxuli.pdf
    • https://uploads.strikinglycdn.com/files/19725850-82c7-43c5-ad6f-a55ebafe6016/metal_gear_solid_2_substance_ps2_rom.pdf
    • https://uploads.strikinglycdn.com/files/a85013c9-07d2-455b-9bdd-ff9f73128e2e/what_is_the_meaning_of_media_system_dependency_theory.pdf
    • https://s3.amazonaws.com/dalava/little_house_on_the_prairie_season_1_episode_23_dailymotion.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001120f.bin
5222dbdfc95a5301b477869e94bc1c864a05d610b758b41aeae49d86d30e02a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1120F 5080 bytes
font_01_sfnt_off00012358.bin
d3303b3ad365468c41b8e7c7600dcf80f5442fa279b32772652f475969843572		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12358 11356 bytes
font_02_sfnt_off0001486b.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1486B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.