Malicious PDF — malware analysis report

Static analysis result for SHA-256 10dcc3ad465a47e7…

MALICIOUS

PDF

80.2 KB Created: 2021-05-02 13:35:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 06be601e980a32692a70bf419b17d64d SHA-1: a2ba33c2b8ddfd9d0bb11795aeb36c385727836c SHA-256: 10dcc3ad465a47e7aaced1f5916eda7b2d39b8e4ecf27aae21db7ac472876714
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a malicious domain, disguised as a meditation guide. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. No scripts were extracted, but the presence of an external URI is a primary indicator of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=how+to+manifest+a+text+meditation
    • https://cdn-cms.f-static.net/uploads/4421970/normal_603b81be420e5.pdf
    • http://idealica-it.website/general_agreement_contract_format3jg1g.pdf
    • http://cleaner360.shop/vikexogifovamizevezakubwdwk.pdf
    • https://cdn-cms.f-static.net/uploads/4402964/normal_602525ffdd4bb.pdf
    • http://kirakexig.mypressonline.com/anaesthesia_tutorial_of_the_week.pdf
    • http://tusapet.iblogger.org/pokemon_card_game_rules.pdf
    • http://tisejamebip.sportsontheweb.net/62838398139.pdf
    • https://static.s123-cdn-static.com/uploads/4403140/normal_5fffcd5935432.pdf
    • http://forexgeeks.net/16544071772edo41.pdf
    • http://viniveba.mywebcommunity.org/40747970080.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://sujunutab.atwebpages.com/78232062685.pdf
    • https://436010f1-0dd7-4950-aec0-3bdf337573e8.filesusr.com/ugd/5a4c69_9844f20efaa94b86acaa86763c1ac014.pdf?index=true
    • https://ba30dffa-51fe-4caa-9472-6f142403a9bb.filesusr.com/ugd/c2007e_6570d03f7912486798dfd0a25cb1ef71.pdf?index=true
    • http://vajekalisafemun.rf.gd/infidel_s_guide_to_the_koran.pdf
    • https://1c8fadd7-09eb-4d2b-9d42-8e747ba5ce52.filesusr.com/ugd/60625b_5a44cd29722646eca93c50e6c1710d4b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/96451fa0-4558-47d1-97ed-470eb9e338f0/why_is_the_service_engine_soon_light_flashing.pdf
    • http://potiwivig.epizy.com/propiedades_y_beneficios_del_aloe_vera.pdf
    • https://201a0bc5-0eb3-4135-8969-828875a6b07d.filesusr.com/ugd/607883_a9fa0d565ef44f79988438003fd9c2b5.pdf?index=true
    • https://297de083-771a-4730-a3b8-a2afe8c7d209.filesusr.com/ugd/47424f_56ee9063b5374f8dbad22ac7abb7eb6f.pdf?index=true
    • http://simirized.epizy.com/ragagaw.pdf
    • https://uploads.strikinglycdn.com/files/5c9eef3f-307b-4d3a-aa25-b22ce30e01aa/gaguzolusowokogejeluzil.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f21c.bin
2d8f5c6469dee9759d6ba80f2ad6eee610b5b02a0d4891441d9e86ebd2966648		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF21C 5044 bytes
font_01_sfnt_off00010341.bin
9fcfd2b2c12c9d480c0beec3ee39f05b9e518edc5177a7a5fcc68dff0371f8a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10341 2092 bytes
font_02_sfnt_off00010ce2.bin
5f85834dc7ce4613c5a1857e34e51d744af36bbe48f3a0b8610a40b3c387a575		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CE2 10836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.