Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a8e626c834175cf…

MALICIOUS

PDF

81.4 KB Created: 2021-03-25 16:33:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 78c699e4d3368b4fd4f0b68007ed11d1 SHA-1: cfbecd4ddfe3579e17b7bcdae8ed3cca9fdbb1a2 SHA-256: 0a8e626c834175cf2dd6d00a90d15c56ac2d25239cb06a6aaff4a5b0fc683d41
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to host a phishing page or download further malware. The document body, though heavily obfuscated, suggests a lure related to awards or pricing, consistent with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=most+important+appropriate+preposition+pdf
    • https://cdn-cms.f-static.net/uploads/4470220/normal_60207b615556d.pdf
    • https://static.s123-cdn-static.com/uploads/4458833/normal_5fc7588522486.pdf
    • http://verifiedbadge-lnstagram.com/honda_lawn_mower_hrx217hya2lnj0.pdf
    • http://summ-ita.space/jagaduh337.pdf
    • http://idealica-italiauficiale.website/kijunuxedivepakaleriv7545w.pdf
    • https://static.s123-cdn-static.com/uploads/4423460/normal_5ffaacbfdaf0b.pdf
    • http://levantemosaic.com/41897846452ky7ny.pdf
    • https://cdn-cms.f-static.net/uploads/4374843/normal_6036005265c8a.pdf
    • https://cdn-cms.f-static.net/uploads/4385436/normal_605641e6a574d.pdf
    • https://static.s123-cdn-static.com/uploads/4408190/normal_600288f2e8cd1.pdf
    • https://static.s123-cdn-static.com/uploads/4375521/normal_5fc9c43070c9e.pdf
    • http://snapchat-alert.com/2017_honda_pilot_maintenance_code_b16qny5m.pdf
    • https://cdn-cms.f-static.net/uploads/4450148/normal_601a9fc649f81.pdf
    • https://cdn-cms.f-static.net/uploads/4425913/normal_602227074de50.pdf
    • http://frasqen.online/toeic_test_2019wm0w9.pdf
    • http://parrrtner.xyz/asientos_contables_mas_comuneszgphc.pdf
    • http://italywow.pro/2018_ap_english_language_and_composition_free_response_answers_question_1e3m6j.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/b0e174f9-f141-44d1-bd2d-027da5d77ba6/how_much_does_adobe_premiere_cost_for_students.pdf
    • https://s3.amazonaws.com/bezorito/parts_for_old_briggs_and_stratton_engines.pdf
    • https://s3.amazonaws.com/sedimeraxufi/video_cutter_free_android.pdf
    • https://s3.amazonaws.com/nawuvud/48223395037.pdf
    • https://s3.amazonaws.com/vokeri/43704578737.pdf
    • https://uploads.strikinglycdn.com/files/b7abbae5-3da6-443a-b021-5b16986674d6/kiwikunelale.pdf
    • https://uploads.strikinglycdn.com/files/8ef95206-5662-42c3-bfd8-72f208c3b7d2/heat_surge_electric_fireplace_adl-2000m-x_remote.pdf
    • https://uploads.strikinglycdn.com/files/e71fa23e-ffab-443a-a54a-55fb581e6055/36644675558.pdf
    • https://s3.amazonaws.com/zufaxepixiguxax/29165990693.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f406.bin
c79b82ec8ed3cf9ebf352e473e8a60dab04d69c3c2dfaa27266cb61cce3bf582		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF406 4948 bytes
font_01_sfnt_off000104bd.bin
49117bf15e49132eba849c2e551c90b3eb71fad8ccdfc255eed273974ade3779		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104BD 10808 bytes
font_02_sfnt_off0001299d.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1299D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.