Malicious PDF — malware analysis report

Static analysis result for SHA-256 08e5009b8cc41a15…

MALICIOUS

PDF

78.1 KB Created: 2021-05-14 15:44:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 79c4645dd2e77cb7be4e5a9ccb115cff SHA-1: 6c20d66904af813980ec88d5f037bc77416f7e81 SHA-256: 08e5009b8cc41a159c54c5e22592ae2a326055f7a833ce0cce8cf6deea38881d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that leads to a domain known for malicious activity, likely intended to deliver a payload or phish for credentials. The document body, though heavily obfuscated, appears to reference 'free keto air fryer recipes', a common lure for phishing campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=free+keto+air+fryer+recipes PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4404727/normal_5fdf4df0ae69e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480408/normal_604138109fcd2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419633/normal_602d6757b9917.pdfIn PDF document text
    • http://passive-income.ru/sewikagug7l7dy.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443804/normal_603ed96b6f415.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485935/normal_5ff5b3a4f1144.pdfIn PDF document text
    • http://chambreop.xyz/aetna_international_claim_form_dubai1nrm3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381964/normal_604f66bc4abdc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380403/normal_5fe78a2d33cf9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/daselex/22880304274.pdfIn PDF document text
    • https://s3.amazonaws.com/didowugorokirug/zipagigigolujokilek.pdfIn PDF document text
    • https://s3.amazonaws.com/wuwabobujasivor/reasons_why_school_uniforms_should_be_banned.pdfIn PDF document text
    • https://s3.amazonaws.com/gelawiweza/how_do_you_save_a_video_project_in_imovie.pdfIn PDF document text
    • https://s3.amazonaws.com/wejuvono/be_used_to_exercises_perfect_english_grammar.pdfIn PDF document text
    • https://s3.amazonaws.com/tonemakopinibem/beadboard_paneling_sheets.pdfIn PDF document text
    • https://s3.amazonaws.com/resabomibogodaw/what_is_rhetorical_questions_and_examples.pdfIn PDF document text
    • https://s3.amazonaws.com/polexebuj/56734836240.pdfIn PDF document text
    • https://s3.amazonaws.com/welanisowari/words_have_power_read_a_banned_book.pdfIn PDF document text
    • https://s3.amazonaws.com/rafiralexezol/the_girl_who_fell_from_the_sky_novel.pdfIn PDF document text
    • https://s3.amazonaws.com/tesodagiwor/ejercicios_de_comprension_lectora_para_primer_grado_de_primaria.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e760.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE760 4780 bytes
SHA-256: 51a3ccac9ccc44e0dc4f97cbd64d5729a07f1bacf0dc676129c0c2c006d357c7
font_01_sfnt_off0000f7c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7C0 11088 bytes
SHA-256: 4cbbc72266a25a2bc458e6c24b6927db4059c6549bf32c0bd760dabb58771b9a
font_02_sfnt_off00011d17.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D17 4324 bytes
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71

Open this report in the interactive analyzer, or submit your own file for analysis.