Malicious PDF — malware analysis report

Static analysis result for SHA-256 12d47c55dc770252…

MALICIOUS

PDF

248.5 KB Created: 2021-05-09 15:03:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c5e6f9fd4c84a27b585933bcd5febd30 SHA-1: b3b19475bc40b7d51216208f1dfacc8b0a8d3608 SHA-256: 12d47c55dc7702520abaf7d6cb8259847f28a90f7b9cb06c952fb84caa71eeb8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, and contains an embedded URI pointing to a suspicious domain. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it might be a generated document. The presence of an external URI in the PDF structure strongly indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9800

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=ayad+akhtar+disgraced+pdf
    • http://trening-ekaterinodar.ru/sivunajv9cdd.pdf
    • http://lozejebivo.scienceontheweb.net/arabic_numbers_1_1000_in_words.pdf
    • http://bokaxakoz.sportsontheweb.net/lattice_energy_pogil_answer_key.pdf
    • http://epaytds.xyz/caremark_prior_authorization_form_for_modafinilxqrsg.pdf
    • http://nuloriwilorij.scienceontheweb.net/jogazarosumijubagoro.pdf
    • http://bitjoms.xyz/54251571286we9t9.pdf
    • http://zoguponuwuxoli.medianewsonline.com/comptia_a_certification_all-in-one_exam_guide_ninth_edition.pdf
    • http://nulivanofika.mygamesonline.org/67593207186.pdf
    • http://instasurprise.online/nijajotesegivozobe0wnwa.pdf
    • http://pipavinekiga.mywebcommunity.org/taking_sides_gary_soto_summary.pdf
    • http://vumamanepu.sportsontheweb.net/introduction_to_operations_research_11th_edition.pdf
    • http://usejus.pro/how_to_pray_in_greekh2rjz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://18d8f76e-0bdd-4b96-b744-fee987eed1b0.filesusr.com/ugd/1486c8_a8a9f8035eea458695a0327f8071e65b.pdf?index=true
    • https://s3.amazonaws.com/nonipesikiri/motorola_surfboard_sbg6580_reset_password.pdf
    • https://uploads.strikinglycdn.com/files/4091664a-745f-4a4d-a641-1cca5fcb44de/gekejitereriwenekufaxapo.pdf
    • https://s3.amazonaws.com/mokixetat/38609920304.pdf
    • http://bupalim.atwebpages.com/what_is_the_salary_of_an_electrical_engineer_in_south_africa.pdf
    • https://c30b87d5-e38e-4f4c-8f61-e356d9eaafe8.filesusr.com/ugd/347120_10c768fc7c4f4e50877f77cb41942de6.pdf?index=true
    • https://s3.amazonaws.com/fizaxo/86132182345.pdf
    • https://3c1efe6f-6e34-41bb-a2c4-2be85dd3cb33.filesusr.com/ugd/41f880_116e5d1a022e406db3cda8bef8a88848.pdf?index=true
    • https://d787a32c-196b-4e99-9c98-3ae3c28023f9.filesusr.com/ugd/05b469_ccc6fd707e044af18b2344aa5bf67b1c.pdf?index=true
    • https://7be8961d-effb-4c78-a255-78c3c9f0be09.filesusr.com/ugd/3dd68e_8db499aff8b240d7b50f5f62f93964ae.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3011dc58-5618-4774-93d3-7dc094e418f6/73985684020.pdf
    • http://boxijekew.atwebpages.com/kenmore_elite_dishwasher_clean_light_flashing_8_times.pdf
    • https://s3.amazonaws.com/nopomewegobij/62966019768.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off0003b193.bin
c09ead7f6ef4b43e4fc67f184b92898147276fcc060510f7ded5598f37372846		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3B193 19564 bytes
font_00_sfnt_off000371d7.bin
767f597b2dd716ba9a43c8de640d51c3c6294e1aac336231578bf46b9aa87812		 pdf-font-stream PDF embedded font (sfnt) at offset 0x371D7 5540 bytes
font_01_sfnt_off000384be.bin
609377def015061a5ad192eecd11e16cd450ca88d5c71927df7990828d7f5f4b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x384BE 13496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.