Malicious PDF — malware analysis report

Static analysis result for SHA-256 1286155b36806e49…

MALICIOUS

PDF

77.9 KB Created: 2021-04-05 11:26:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: dc45d9d95850b65c5a4c443a7a3908b6 SHA-1: f096df4c7498d67a2cc4f421d51a7a4c8115d089 SHA-256: 1286155b36806e49599a4f0bbf9f2474155228e1c961d1e34763b307b087626a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that masquerades as a Google Sheets phone number link, likely intended to trick users into clicking it. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan PDF. While no scripts were directly extracted, the presence of external URIs and the overall classification suggest the document's purpose is to redirect users to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=google+sheets+phone+number+link PDF link annotation
    • http://kvadro63.ru/645295061909l2ub.pdfIn PDF document text
    • http://bigops.fun/xamigave9ycve.pdfIn PDF document text
    • http://daludaja.getenjoyment.net/perdagangan_manusia_jurnal.pdfIn PDF document text
    • http://claire-irk.ru/xewovilipopifete04cyw.pdfIn PDF document text
    • https://cdn.sqhk.co/minamojazi/iigctgf/word_search_puzzles_for_free_download.pdfIn PDF document text
    • http://wibedepotemuru.22web.org/minute_math_worksheets_multiplication_and_division.pdfIn PDF document text
    • http://samozanyat.info/86235802310zfhsc.pdfIn PDF document text
    • http://lnstagramcopyrightservices.org/como_reforzar_el_sistema_inmunologico_en_niospwlpi.pdfIn PDF document text
    • http://vafakewa.iblogger.org/bodybuilding_fitness.pdfIn PDF document text
    • https://cdn.sqhk.co/kosojevevoxo/hthig09/wukebapemirikegizirawuli.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fakuguvil/bootloader_samsung_ace_3.pdfIn PDF document text
    • http://gepafelixadu.onlinewebshop.net/mathematics_10_12_download.pdfIn PDF document text
    • https://s3.amazonaws.com/gozifep/85490067543.pdfIn PDF document text
    • http://lozekav.epizy.com/us_navy_aviation_boatswains_mate.pdfIn PDF document text
    • https://s3.amazonaws.com/jewizopukuni/what_is_operating_system.pdfIn PDF document text
    • https://s3.amazonaws.com/vipuxafol/70375752317.pdfIn PDF document text
    • https://s3.amazonaws.com/fotojipifuzitul/vasotejulel.pdfIn PDF document text
    • http://pixafur.atwebpages.com/9785599621.pdfIn PDF document text
    • http://pigozezidum.rf.gd/tefuxesukunet.pdfIn PDF document text
    • http://nupuzawov.onlinewebshop.net/american_idiot_album_lyrics.pdfIn PDF document text
    • https://s3.amazonaws.com/vebisop/excel_budget_template_for_event.pdfIn PDF document text
    • http://kadegezopofog.rf.gd/philips_norelco_series_9000_prestige_electric_razor.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f395.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF395 5256 bytes
SHA-256: e8f851b9d3b58a3366f23ea035e34ec1a71cde52bea7ebac98315d58ce61bcbc
font_01_sfnt_off00010551.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10551 10992 bytes
SHA-256: 9d7c4d76d16fc9e6550536609ed4c4ad7beb82e4d5a9760cd3d8ef21dadbd09e

Open this report in the interactive analyzer, or submit your own file for analysis.