Malicious PDF — malware analysis report

Static analysis result for SHA-256 102997f58e956cc9…

MALICIOUS

PDF

77.6 KB Created: 2021-03-12 13:54:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: be1febf38f9727ab32dbf71c36d1211f SHA-1: ac481169c0ab6c23adca85dfa7969e17d63de19a SHA-256: 102997f58e956cc911a060c989d70e56e8aaae69bb66f7af457996c6efd64f39
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains a link to a known malicious redirector, indicating an attempt to phish or deliver a payload. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URL point towards a social engineering attack, likely a phishing lure for an award or notification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=the+tempest+themes+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4481270/normal_5fd3bce94d72b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480173/normal_6004ee0e245c1.pdfIn PDF document text
    • http://merogerofame.66ghz.com/xozonixova.pdfIn PDF document text
    • http://hookup671.site/campo_de_estudio_de_la_economia_politica3jg20.pdfIn PDF document text
    • http://jodopafipunew.22web.org/happy_birthday_wishes_sister_image.pdfIn PDF document text
    • http://top-agent.ru/65121384140123d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fugirar.epizy.com/how_to_apply_for_enhanced_drivers_license_ny.pdfIn PDF document text
    • https://7fd672c9-0ac8-42d3-9d3c-9ebb2fbea2b4.filesusr.com/ugd/92785a_762ec9bf081942928bb8327dab190091.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/debamijizozexo/57745374990.pdfIn PDF document text
    • https://s3.amazonaws.com/dazawojob/desert_themed_cat_names.pdfIn PDF document text
    • https://d4078116-a2d5-466f-97e6-20d899f6ca30.filesusr.com/ugd/576447_1bbd905e7b7e49bda5c2cbf82fdf8cba.pdf?index=trueIn PDF document text
    • http://mudivakerimenog.epizy.com/63754636182.pdfIn PDF document text
    • http://toxalotivip.epizy.com/xabemupe.pdfIn PDF document text
    • https://80cb706b-a9cc-40e6-9cd2-ad5688d6c4a8.filesusr.com/ugd/c84a73_6d962f6326a6454da87cb0600e533ab0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/panalipolifod/asus_rt-n53_review.pdfIn PDF document text
    • https://486bfeb6-87d8-40a3-812f-3449909c9139.filesusr.com/ugd/81b904_efa4a79ab74d4a5986dfdf36e63ace9b.pdf?index=trueIn PDF document text
    • https://dc688580-c0ec-4ade-910b-7abffd870ab4.filesusr.com/ugd/096b61_2acaadf604d9406d802dfa78c3d3a0d7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sojaxub/xeluw.pdfIn PDF document text
    • https://s3.amazonaws.com/nuruvapozixix/rizojuvuxino.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f63d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF63D 4892 bytes
SHA-256: 032f5d45fba4980a7e3ec2e9e88c714dd08f9944089b94acc584a9b7d9947eca
font_01_sfnt_off000106c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106C1 10184 bytes
SHA-256: 9cec06af5a695361dc87ba0d42329f98a4277e037a3688f7d26dba395f47a13e

Open this report in the interactive analyzer, or submit your own file for analysis.