Malicious PDF — malware analysis report

Static analysis result for SHA-256 1279605abf008cbc…

MALICIOUS

PDF

78.3 KB Created: 2021-04-02 15:26:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7c4ec990e11a05ef6738b0ddeeec220e SHA-1: d10e1b5ab24c5163541dc06caa36ed741e13271e SHA-256: 1279605abf008cbc3e12c9ff547b985a1f78bc41f7ccdeeaa98e216c70aca4c0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a suspicious domain, likely serving as a lure for users to download further malicious content. No scripts were extracted, but the presence of an external URI suggests an attempt to redirect the user to a malicious resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=vector+voyage+worksheet+1+download
    • https://levevuwakute.weebly.com/uploads/1/3/4/9/134904524/b3cb4.pdf
    • http://gdztut.com/bypass_android_7._0_samsungqyzzh.pdf
    • http://filmera.ru/jasper_reports_new_line_in_text_fieldmejls.pdf
    • http://parkji5x.xyz/58967686605kpjpp.pdf
    • http://wemuwugisenoro.iblogger.org/96681696850.pdf
    • http://fenuxove.22web.org/visesudolakora.pdf
    • https://doxekitonibi.weebly.com/uploads/1/3/5/3/135326555/sujezobuzafojuzogav.pdf
    • http://kersita.fun/is_a_hypothesis_and_theory_the_same_thinguxl3h.pdf
    • http://aazzzry.space/fusiform_skeletal_muscle_structure8e48y.pdf
    • http://bemowasogikoj.22web.org/barikuder.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jofawapedoguw.rf.gd/miguel_de_cervantes_dom_quixote.pdf
    • http://femubavavozemag.epizy.com/cantos_catolicos_acordes.pdf
    • https://cee4a208-09ac-40e0-983f-4c2cc776acbe.filesusr.com/ugd/5ed537_8378c9cda3fe4508ba3ff79062051a32.pdf?index=true
    • https://ba85394b-11ac-4ca4-926b-74ca936c52e1.filesusr.com/ugd/5ccfc8_1a0b0c18143b4a79934b8ac80dba0e12.pdf?index=true
    • http://teraropabu.epizy.com/properties_of_austenite_ferrite_pearlite_martensite.pdf
    • http://dazotejake.rf.gd/komplikasi_bronkopneumonia_pada_anak.pdf
    • https://f200304d-316b-45a9-b05c-680123ec6d1a.filesusr.com/ugd/aad1a2_9a01fc2c1f634d0f819e5a8033f220b2.pdf?index=true
    • http://zanebinelit.rf.gd/zemivediti.pdf
    • http://foweroboxufafuv.epizy.com/human_behavior_theory_and_social_work_practice.pdf
    • https://2a4c341d-9af7-4f89-b48a-1b926ad6ced7.filesusr.com/ugd/dd6616_b6c8d1e1d9d3424b8b416a9fd136eb70.pdf?index=true
    • https://e216d865-ddc7-438b-99b2-64609380b1bb.filesusr.com/ugd/7ae8b3_3e477884a72a487b9415bd4dc3ce0321.pdf?index=true
    • https://92ddf5cc-4ce7-4caf-b117-8241c553a727.filesusr.com/ugd/42bae0_a862bb3360bd4ec9804cc551c5af32c2.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0e4.bin
3145db33ec44dc06a449bc6009e370537266b8604cd58afaa5402f352149afe3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0E4 5536 bytes
font_01_sfnt_off000103e3.bin
0720e9d64ca1e7d1e47bca54e2c36449027ec817430ce5accd50d1f8b0ec950e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103E3 11160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.