Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f2add3c6447f84a…

MALICIOUS

PDF

86.2 KB Created: 2021-02-11 04:13:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 04f17cbbd1def3abfe6530a312264984 SHA-1: a0401ed06ac591ad3b1bb6b568f4b2f478199b79 SHA-256: 0f2add3c6447f84a4fd1516cd414a261528c15f965afbf6ebc492cf43bbe78a9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that points to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF as malicious. The document body, though heavily obfuscated, appears to contain text related to 'South seas hotel myrtle beach south carolina', suggesting a lure for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=south+seas+hotel+myrtle+beach+south+carolina PDF link annotation
    • http://canonsburglake.org/xodozitalodojanajapjuygt.pdfIn PDF document text
    • https://cdn.sqhk.co/gufezitaxato/bxEghhK/spelling_word_games_for_5th_graders.pdfIn PDF document text
    • https://cdn.sqhk.co/zewumabigige/jjx1gcY/walking_dead_season_11_full_cast.pdfIn PDF document text
    • http://tacfitproducts.com/570133682013etju.pdfIn PDF document text
    • http://firstsecu-paypal.com/44137972187en841.pdfIn PDF document text
    • https://cdn.sqhk.co/pajokiman/eKihrj6/34_85.pdfIn PDF document text
    • http://zakofuta.66ghz.com/mepufefimaxulovipexek.pdfIn PDF document text
    • https://cdn.sqhk.co/zikufivol/djiFvii/lemon_cake_recipe_with_sour_cream.pdfIn PDF document text
    • http://juwapes.22web.org/43414231953.pdfIn PDF document text
    • https://cdn.sqhk.co/feketukadoz/hidY92I/bomber_jacket_outfits_guys.pdfIn PDF document text
    • https://cdn.sqhk.co/vuwewiwudesi/jjiatWH/61196905466.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/mixanaz/bim_building_information_modeling_adalah.pdfIn PDF document text
    • https://s3.amazonaws.com/setaxilitozuko/reporter_morgan_chesky.pdfIn PDF document text
    • https://s3.amazonaws.com/gixawetopoli/wallpaper_hd_new_2018.pdfIn PDF document text
    • http://fufagagebo.epizy.com/27978524296.pdfIn PDF document text
    • https://s3.amazonaws.com/gavobawum/parasomnias_infantiles.pdfIn PDF document text
    • https://s3.amazonaws.com/bitajemisajoz/13426050569.pdfIn PDF document text
    • https://s3.amazonaws.com/xaliwalufoguni/chicken_invaders_full_version.pdfIn PDF document text
    • http://sufiwufefolama.rf.gd/puwipuxovoxonokadana.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001107e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1107E 5384 bytes
SHA-256: f5cbc6a67a2d6fdab9a3f79e2f143f10331810e58380ce71c3898aca8487dc39
font_01_sfnt_off000122a8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x122A8 12360 bytes
SHA-256: 00254449b3fb26582e06a02ce14aefe28def49ec493e3877c66712ad734c606b

Open this report in the interactive analyzer, or submit your own file for analysis.