Malicious PDF — malware analysis report

Static analysis result for SHA-256 12d5d540378f4567…

MALICIOUS

PDF

78.2 KB Created: 2021-05-20 09:41:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 09ec4543ddafc9d512fa62cb3a6c58e7 SHA-1: d82b43441a632e90857757cef66e298b4c98a8b0 SHA-256: 12d5d540378f4567c6462c4fbab93422dd315d5e4fbb1863a94e8026569bb216
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a lure related to business advantages, but the primary malicious indicator is the embedded URI pointing to a suspicious domain. This suggests the document is designed to trick users into visiting a malicious site, likely for phishing or malware distribution. No scripts were extracted, but the PDF structure and embedded URI are strong indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=five+advantages+of+sole+proprietorship+business
    • https://cdn-cms.f-static.net/uploads/4474223/normal_6023bfa99e75f.pdf
    • https://cdn-cms.f-static.net/uploads/4389107/normal_604a72f1639cc.pdf
    • https://static.s123-cdn-static.com/uploads/4477173/normal_5ff338ac14137.pdf
    • https://cdn-cms.f-static.net/uploads/4369629/normal_600c8d991b593.pdf
    • https://static.s123-cdn-static.com/uploads/4408992/normal_60079e082df86.pdf
    • https://cdn-cms.f-static.net/uploads/4385880/normal_5fd3324866f14.pdf
    • https://cdn-cms.f-static.net/uploads/4421614/normal_60265b2627585.pdf
    • https://cdn-cms.f-static.net/uploads/4408593/normal_6041b8308a722.pdf
    • https://cdn-cms.f-static.net/uploads/4421466/normal_606963cce4322.pdf
    • https://static.s123-cdn-static.com/uploads/4413973/normal_6007a070bcf80.pdf
    • https://static.s123-cdn-static.com/uploads/4466370/normal_5ff4e0694e6df.pdf
    • https://cdn-cms.f-static.net/uploads/4475562/normal_603cab07e9966.pdf
    • https://static.s123-cdn-static.com/uploads/4470401/normal_60061c2b64dc6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9106f831-2cbd-4f51-985f-8788ce8bf5b4/apollo_13_book_by_jim_lovell.pdf
    • https://uploads.strikinglycdn.com/files/c060d7fd-94cd-43c3-a778-6b95a8ecd565/taking_sides_gary_soto_audiobook.pdf
    • https://uploads.strikinglycdn.com/files/6f0274d0-78b6-4979-b341-88dc1a58f296/is_roadmaster_a_good_brand.pdf
    • https://uploads.strikinglycdn.com/files/e914cf8d-9363-47f3-b9f4-94da405f7cf2/gorillaz_rise_of_the_ogre.pdf
    • https://uploads.strikinglycdn.com/files/9cff5b89-0092-40fc-ae12-6c59edda126e/auvio_wireless_headphones_battery_replacement.pdf
    • https://uploads.strikinglycdn.com/files/8c409d69-f616-417b-9f65-e157477b94af/how_do_you_fix_a_minor_sewing_machine_fault.pdf
    • https://uploads.strikinglycdn.com/files/c6cab964-c91e-4145-ba3c-3079d5420bcf/samsung_m2825dw_printer_driver.pdf
    • https://uploads.strikinglycdn.com/files/b279ac0b-416c-497d-a3f7-0fa85eb0fc02/lady_bracknell_the_importance_of_being_earnest_character_analysis.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f197.bin
4040f9d993b192170bab0566047929cadd1057ddf0274cc19dff8030d494889a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF197 5456 bytes
font_01_sfnt_off00010427.bin
ba68620aa49003aa2af75cbc4c49293ef959275823a03f61f720e7ae182d7581		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10427 11540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.