Malicious PDF — malware analysis report

Static analysis result for SHA-256 0fc4a6bd34382b42…

MALICIOUS

PDF

81.8 KB Created: 2021-06-10 12:38:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 93b115c69dd99a21e61cd4c0de528354 SHA-1: ce4ed6fb50f498eec68a56a4b3379278142d68e5 SHA-256: 0fc4a6bd34382b429cd1b1b07bd680a21924ea6592b1bbdb2fbb2a2e207d4a0b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating it's a phishing trojan. The embedded URL points to a domain associated with malicious activity, disguised as a template download. While no scripts were explicitly extracted, the PDF structure and heuristics suggest it's designed to exploit users through social engineering.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://coretry.ru/pbw?utm_term=company+profile+design+template+psd+free+download
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/83f92abb-9113-40a9-81dc-5124540ae281/how_do_i_contact_canada_customs_about_my_package.pdf
    • http://fezosubi.pbworks.com/w/file/fetch/144702858/step_common_to_lactic_acid_fermentation_and_aerobic_respiration.pdf
    • http://kufujibumufa.pbworks.com/w/file/fetch/144413373/63455188248.pdf
    • https://uploads.strikinglycdn.com/files/25adf11e-b104-4796-9780-484e94ce5346/zobavibovuve.pdf
    • http://wafijovodek.pbworks.com/w/file/fetch/144948453/62356486535.pdf
    • https://uploads.strikinglycdn.com/files/cf93be76-46e3-4a14-b956-32af4f395ec3/chrono_trigger_snes_walkthrough.pdf
    • https://uploads.strikinglycdn.com/files/35ea2166-b180-48d7-a9cd-bc8608fb32ae/81341764060.pdf
    • http://fisukafetif.pbworks.com/f/vixarivegukome.pdf
    • http://buxozodevoge.pbworks.com/f/easy_topics_for_chemistry_investigatory_project_class_12.pdf
    • http://bofamawetodo.pbworks.com/f/lumunumevabali.pdf
    • http://fisakujimet.pbworks.com/w/file/fetch/144812694/quran_arabic_english_transliteration.pdf
    • https://uploads.strikinglycdn.com/files/b4bb10df-af93-4fb7-9f99-ded954a6dff2/does_panda_express_orange_chicken_have_egg.pdf
    • http://buvavipoluvu.pbworks.com/w/file/fetch/144658482/standar_auditing_aaoifi.pdf
    • http://bemulopawed.pbworks.com/f/how_does_god_reveal_himself_in_your_daily_life.pdf
    • http://lopofemusun.pbworks.com/w/file/fetch/144520014/gabikijiriketetaxar.pdf
    • https://uploads.strikinglycdn.com/files/dc5069d5-73b7-4ff3-a480-95072f961c7b/exercice_suite_arithmtico_gomtrique_terminale_es_type_bac.pdf
    • https://uploads.strikinglycdn.com/files/4685dbcd-aa54-4069-8ef9-7ab70a032cc6/15022273728.pdf
    • https://uploads.strikinglycdn.com/files/ab08866c-d542-4eb3-ba15-39c049e6f17a/wizejegosanixugi.pdf
    • http://ravaxes.pbworks.com/w/file/fetch/144794421/tufelowoxomibileraf.pdf
    • https://uploads.strikinglycdn.com/files/c9f212c1-def8-458d-98ef-9d83c7fe97dc/gaggia_brera_espresso_machine_review.pdf
    • http://dowiginade.pbworks.com/w/file/fetch/144820626/92911788351.pdf
    • http://sukagafamo.pbworks.com/w/file/fetch/144729156/cheat_gunship_battle_helicopter_3d_mod_apk_android_1.pdf
    • http://bojifimaral.pbworks.com/f/vozanexifagugema.pdf
    • https://uploads.strikinglycdn.com/files/55a6bbec-9093-443b-9f14-ff7ebeae3561/possessive_adjectives_and_possessive_pronouns_worksheet_answers.pdf
    • http://pezaloribed.pbworks.com/f/chapter_3_cell_structure_and_function_vocabulary_practice_worksheet_answers.pdf
    • https://uploads.strikinglycdn.com/files/fa7a01c5-c501-49a6-ab5b-58dc0669b58c/13382087331.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101ab.bin
8d83e627267199d202ef534b6304645dc9fad67867bb03d7545aae2d4d8b54d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101AB 5460 bytes
font_01_sfnt_off00011439.bin
738402ef779aed753b46bfb8c9bd97081be29e3fb6d8d8572cbf7053b46321c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11439 10980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.