Malicious PDF — malware analysis report

Static analysis result for SHA-256 08c8475e8b038aff…

MALICIOUS

PDF

78.7 KB Created: 2021-03-09 14:06:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 78f5a7ab32fd848f5a9c150f71de6143 SHA-1: d66312026bdbbb943bf4a5fc9fd60591c798b15d SHA-256: 08c8475e8b038affbe3a8e9a57e585dda056f25bce9238298a3415625ee588a9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=fishing+guides+sebastian+inlet+florida PDF link annotation
    • http://fasekafalig.scienceontheweb.net/mercruiser_3.0_engine_block_for_sale.pdfIn PDF document text
    • http://rebezun.mygamesonline.org/baby_shower_biblico.pdfIn PDF document text
    • http://gadetebes.sportsontheweb.net/best_way_to_get_rid_of_acne_scars_on_face_fast.pdfIn PDF document text
    • https://cdn.sqhk.co/pafevola/dlG6Zkp/xakiriji.pdfIn PDF document text
    • https://cdn.sqhk.co/jijatidos/ggdgdgd/mexican_restaurants_storm_lake_ia.pdfIn PDF document text
    • http://jijuduli.mywebcommunity.org/volunteer_training_drills_a_year_of_weekly_drills.pdfIn PDF document text
    • https://lawukexudemodu.weebly.com/uploads/1/3/4/0/134041757/xutuguro.pdfIn PDF document text
    • https://cdn.sqhk.co/xinefegepe/iijjPnH/55766104466.pdfIn PDF document text
    • https://xaxidotuviw.weebly.com/uploads/1/3/0/9/130968933/fesatufasol_zositok_vasadizile_lebofak.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cc968bdf-8a18-4a65-a72d-893c706ef441.filesusr.com/ugd/bae363_e61799ffb0a6441ba72aeffbed67957a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/siwixomudit/acpgbi_colorectal_cancer_guidelines_2017.pdfIn PDF document text
    • https://aee666f7-65d2-4416-8089-42e5bd85255d.filesusr.com/ugd/c4036c_41a952839b824b5c98968ec850a597f1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vavejijitatofu/how_to_find_the_value_of_n_in_geometric_sequence.pdfIn PDF document text
    • http://gezojetisab.epizy.com/79858712735.pdfIn PDF document text
    • http://tudojofomako.epizy.com/54831325373.pdfIn PDF document text
    • https://s3.amazonaws.com/topipovikapari/jenkins_artifactory_plugin_latest_artifact.pdfIn PDF document text
    • https://ce099f17-eb12-430b-a452-8d789b3ee5a8.filesusr.com/ugd/aef5b7_27e2943424b54b33b406755563a748e9.pdf?index=trueIn PDF document text
    • https://7f03322d-63d6-449b-a8c2-a80beffeb2b6.filesusr.com/ugd/2994dd_064582de31eb48a2a2f108f11660a472.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xeponodij/how_to_hack_dsi_parental_controls.pdfIn PDF document text
    • http://wupubobetob.epizy.com/93302289761.pdfIn PDF document text
    • https://s3.amazonaws.com/fekife/brother_sewing_machine_jx2517_manual.pdfIn PDF document text
    • https://dacf5b84-f80e-4bd8-bb7f-22aad20a1cd8.filesusr.com/ugd/285be4_e8fa16efcebe4331b35d560dbbf4550b.pdf?index=trueIn PDF document text
    • http://jubogaju.atwebpages.com/50827809710.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f729.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF729 5264 bytes
SHA-256: 9c648584aaa5a3386fbc359980e805303506d1481eefe78f8465a2cdc5bd6f4d
font_01_sfnt_off00010909.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10909 10648 bytes
SHA-256: 7a0a6666dc6ab7f034c461bea3d74b00bc384b98479a127ab138198b485aeeb6

Open this report in the interactive analyzer, or submit your own file for analysis.