Malicious PDF — malware analysis report

Static analysis result for SHA-256 0af0c87410353911…

MALICIOUS

PDF

92.1 KB Created: 2021-03-17 05:40:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b30b99be1f9aa0c88c881deb6a866110 SHA-1: 2215b532c85f021489c46c2ecbb6a034ea15e3c7 SHA-256: 0af0c87410353911d1d50238737318007ab1ba770429c568bacc449045898830
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, which is likely a phishing lure. ClamAV detection and ML classification strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a deceptive lure related to a book search, aiming to redirect the user to the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=enderton+mathematical+introduction+to+logic+pdf
    • https://cdn-cms.f-static.net/uploads/4374364/normal_6010764a030d8.pdf
    • http://supportcopyright.net/20555835911h6fc3.pdf
    • http://13millions-warzone.store/how_to_program_second_dish_remote69k4q.pdf
    • http://expressday.online/905780889015h5yw.pdf
    • http://wordsidepost.top/midepawekatabt9r1z.pdf
    • http://circulshtangcalip.website/cuanto_son_3_metros_en_centimetrosryky4.pdf
    • http://discount50it.pro/zewitenifamivomodimelo2zt9l.pdf
    • http://harmony-market.ru/mapobidevekagixiwijau1j0g.pdf
    • https://static.s123-cdn-static.com/uploads/4481509/normal_5fcf4ca3bc396.pdf
    • http://sarhello.online/cursos_de_ingles_en_orlando_floridazvqs3.pdf
    • https://static.s123-cdn-static.com/uploads/4366630/normal_5fdfb6d752357.pdf
    • http://select-get.top/227981994078pyta.pdf
    • http://ufenmac.com/food_chain_drawing_worksheethltem.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/0e84b688-44c0-4399-be8a-6ea4f9930fa8/gifoletad.pdf
    • https://s3.amazonaws.com/daraniwekamidir/big_data_platform_engineer_job_description.pdf
    • https://s3.amazonaws.com/fikuvine/walter_benjamin_aura_meaning.pdf
    • https://uploads.strikinglycdn.com/files/58ba0428-3c86-4b5e-bc18-2821c6ffcbc7/oster_6_cup_rice_cooker_replacement_parts.pdf
    • https://uploads.strikinglycdn.com/files/fcadf96a-d257-4e31-867d-52c9415066b7/37853009408.pdf
    • https://s3.amazonaws.com/bokelur/buy_aluminium_sheet_near_me.pdf
    • https://uploads.strikinglycdn.com/files/96f63828-cca0-48d9-b4dc-b3613d54418a/how_to_set_up_baby_einstein_door_jumper.pdf
    • https://s3.amazonaws.com/babetafaperaxov/how_to_set_clock_on_pioneer_deh-1100mp.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f82a.bin
58e47d36f196fd1dba41aa1f20dc7dd8f2ac30042d0718957526d5aa70af09ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF82A 5228 bytes
font_01_sfnt_off000109c1.bin
bd5394ab4de21f28ebcec8ba781444627981b4d3acbbfc51b942f71f6727d501		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109C1 12100 bytes
font_02_sfnt_off00013311.bin
6defb20a010a9d46aa6e37e64ed19b5215123f15cc24a57c7db47d9c6b2c778c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13311 19988 bytes
font_03_sfnt_off00015410.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15410 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.