Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f43164ed2e90d01…

MALICIOUS

PDF

79.5 KB Created: 2021-03-19 23:54:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4a6ef6004badfdcbb7379b0dbd33ef0c SHA-1: 40ebddc6fd378a0798913df37663ddaa4d237896 SHA-256: 0f43164ed2e90d01138141cbb636dcc8901565ad7a2848096f4bd601ce5ce238
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, suggesting it's part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains text related to 'love ringtones 2019', indicating a lure to trick users into downloading content. No scripts were extracted, but the presence of embedded URLs and the overall detection profile strongly suggest a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=love+ringtones+2019
    • http://aycotoro5.xyz/simplifying_fractions_to_lowest_terms_worksheetw9pmw.pdf
    • https://cdn.sqhk.co/noligigibar/jgiohaA/best_rechargeable_hand_warmer_for_skiing.pdf
    • http://uscarins.info/zubalidotinokiwbwb.pdf
    • http://civiliscmq.online/minnesota_millionaire_raffle_2017_winning_numbers6k9os.pdf
    • https://cdn.sqhk.co/kugefiruxat/chf5ezh/20585997561.pdf
    • https://static.s123-cdn-static.com/uploads/4407998/normal_60013904e67bc.pdf
    • http://desenusexewu.iblogger.org/dipubokogokazuvusofiraj.pdf
    • http://justamorem.com/how_to_set_time_on_dsc_keypadx14mi.pdf
    • https://cdn-cms.f-static.net/uploads/4379841/normal_60490c3b01ef0.pdf
    • http://rubka.space/dakigopazejusugubek3zq16.pdf
    • http://soldatskaya6.ru/how_to_set_temperature_on_a_whirlpool_fridgedt990.pdf
    • https://cdn.sqhk.co/vagizabibo/7ghheib/juicy_fruit_bubble_gum_price.pdf
    • https://cdn.sqhk.co/timugulirebu/jrIAzPY/tojiratu.pdf
    • https://cdn.sqhk.co/vumivatuvi/dEsif9k/marketing_jobs_salary_florida.pdf
    • https://static.s123-cdn-static.com/uploads/4462351/normal_5fd05e694cd10.pdf
    • https://static.s123-cdn-static.com/uploads/4424040/normal_60028d3313f3d.pdf
    • http://unityfree.xyz/kadukupugosibat0bap.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1610aef8-13bd-4563-b8c8-7afe8a505054/what_is_the_story_of_howls_moving_castle.pdf
    • https://uploads.strikinglycdn.com/files/4c4cf93f-6b9e-4f2d-a5c1-634aa2bb3ac2/19565451915.pdf
    • http://xifabemifuxiza.rf.gd/11217571819.pdf
    • http://nozuwodapa.epizy.com/lokugilefilul.pdf
    • https://uploads.strikinglycdn.com/files/dd91ea0f-b88e-496e-9c14-d6468332e140/metal_gear_solid_v_ground_zeroes_review_ps4.pdf
    • http://dafumubogoma.epizy.com/2008_ford_escape_limited_tire_size.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb7a.bin
9c268d8f5b86521d8da879a6b67a49ab15a1e094cc09605ac2f6503117bac565		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB7A 5096 bytes
font_01_sfnt_off00010cf5.bin
2f76499cf0e2c01c6087d5e83de9f53c34678a68d644a7500a88817791ffa00d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CF5 10536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.