Malicious PDF — malware analysis report

Static analysis result for SHA-256 0cbc9f94c8fc4684…

MALICIOUS

PDF

77.9 KB Created: 2021-03-17 17:40:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 600a85960b32a004e3a4ca4b3e7945dc SHA-1: 799a4e916ed71b8b16cc84ffb15480f81a8fd2b9 SHA-256: 0cbc9f94c8fc4684bbe6f16c64fd242df49b6e5136356f1d6845a6b9a0d15276
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified by both heuristics and ClamAV as malicious. The ML classifier also flagged the PDF with high confidence. Although the document body is heavily obfuscated, the presence of the external URI suggests an attempt to redirect the user to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=evenflo+tribute+lx+convertible+car+seat+installation
    • https://static.s123-cdn-static.com/uploads/4376088/normal_5ffe4e20ad201.pdf
    • http://navalny.design/how_fast_does_a_110cc_quad_gooy8hd.pdf
    • https://static.s123-cdn-static.com/uploads/4427079/normal_5febf7eff0f67.pdf
    • https://lujukote.weebly.com/uploads/1/3/2/7/132712447/milivugimega.pdf
    • http://rezexepenoma.scienceontheweb.net/42854633825.pdf
    • http://avit0.pro/how_to_know_if_your_pet_bird_likes_youzmpj9.pdf
    • https://letotanuvimipe.weebly.com/uploads/1/3/4/5/134598603/ddc6921f.pdf
    • https://static.s123-cdn-static.com/uploads/4472185/normal_5fcb8d683e5e6.pdf
    • https://static.s123-cdn-static.com/uploads/4454977/normal_5ff661fec213b.pdf
    • https://laxivaxof.weebly.com/uploads/1/3/0/8/130874385/80c12af45796c.pdf
    • https://lafadulow.weebly.com/uploads/1/3/4/5/134591129/59a9c.pdf
    • http://kijekidajefi.getenjoyment.net/54251301796.pdf
    • https://cdn-cms.f-static.net/uploads/4387036/normal_60220e9253bff.pdf
    • https://nanuvofekoredam.weebly.com/uploads/1/3/5/3/135385966/71996a3f.pdf
    • http://canlisohbetim.net/dymo_letratag_ink_not_working9to89.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kuxogazixup.rf.gd/list_of_aerobic_bacteria.pdf
    • http://jabejanaboz.atwebpages.com/26101590835.pdf
    • https://uploads.strikinglycdn.com/files/1908b6cd-917f-4c76-a6bb-9f8d1cb78a58/sejufog.pdf
    • https://uploads.strikinglycdn.com/files/46ee4aba-5461-4bb9-a7fe-7d795c064953/88106676098.pdf
    • https://uploads.strikinglycdn.com/files/a1c8b1d7-0117-4910-8207-6a772f9acab5/que_es_un_lider_liberal_ejemplo.pdf
    • http://jopumogezev.epizy.com/2014_prius_c_owners_manual.pdf
    • https://uploads.strikinglycdn.com/files/9f49c83b-59c3-4155-8478-5eee3e2d23bf/altec_lansing_mini_lifejacket_jolt_portable_bluetooth_speaker_with_lights_black.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f459.bin
7080a714a373bafec47f07cbc184075e4250f8bda2b6be1592f004b8db289fd6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF459 5100 bytes
font_01_sfnt_off000105cf.bin
bf8f943978f12fab6f30799f90cd98db99ea729e788f9edbab026e694cb18807		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105CF 10684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.