Malicious PDF — malware analysis report

Static analysis result for SHA-256 10f1b4e41a9b25f4…

MALICIOUS

PDF

89.8 KB Created: 2021-03-17 08:57:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 5b181eb7747aa5ef0fb7edc5ae7590ee SHA-1: 86de1fba717563b18f270c18da003c8e92ebc771 SHA-256: 10f1b4e41a9b25f40f71a38723ac4b4a7457fb6ac8f786ac2e2c232897b84398
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a suspicious domain, suggesting a phishing or redirection attempt. The document body, though heavily obfuscated, contains text related to the URL's query parameter, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=what+percentage+of+oxygen+do+you+breathe+in PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4463808/normal_5fcf510381800.pdfIn PDF document text
    • https://cdn.sqhk.co/bekutojeke/x3TjdFA/bandi_saroj_kumar_phone_number.pdfIn PDF document text
    • https://cdn.sqhk.co/madufuxenuw/2jdZI4D/aesthetic_space_wallpapers_iphone.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368951/normal_6033cd3aac574.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392195/normal_604aba241df78.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384851/normal_60176137345fb.pdfIn PDF document text
    • https://cdn.sqhk.co/lasumalena/JDhbibE/.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426267/normal_5fe3170ca52ad.pdfIn PDF document text
    • https://cdn.sqhk.co/nujudemugipi/icghh1a/baby_yoda_animatronic_gamestop.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384295/normal_602874dab89fc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404297/normal_5fd3cc291f4dc.pdfIn PDF document text
    • https://cdn.sqhk.co/vimexuda/Ujejigh/limemojilotemegelerigit.pdfIn PDF document text
    • https://cdn.sqhk.co/lezebulodiw/G1ziihi/grand_theft_auto_vice_city_remastered_pc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xubifupi/vevosisowunazexibapatasif.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc90cec9-93cf-45df-8854-f57427040dd6/a_wheel_in_the_middle_of_a_wheel_kjv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3941fe79-60a8-4b86-9845-7180686762b9/nexozojupifulatutifegasiv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1aacdd10-443d-455c-a776-51c21a7db03b/how_much_notice_to_terminate_month_to_month_lease.pdfIn PDF document text
    • https://s3.amazonaws.com/xukirizugukugi/74923941057.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd39009d-99ea-4e69-a87c-c4f3b27593c1/fezafupotemadamubo.pdfIn PDF document text
    • https://s3.amazonaws.com/ronatiduzoxij/after_twenty_years_by_o_henry_character_analysis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/567c076a-f42d-4b38-ad04-e99512bbc5d8/gopro_hero_4_silver_vs_xiaomi_yi_4k.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011e19.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E19 5528 bytes
SHA-256: 8cd299675cc645adc7a9c6812bef6bb2b1cd865b8bd2f1bf63395e91f32828f1
font_01_sfnt_off000130f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x130F6 12572 bytes
SHA-256: 00a543f092706e7bc892b0d3cd3095eb2bd63242d227ccbf74c12b681ad42f78

Open this report in the interactive analyzer, or submit your own file for analysis.