Malicious PDF — malware analysis report

Static analysis result for SHA-256 13b5e5eb75d1a54a…

MALICIOUS

PDF

70.6 KB Created: 2021-03-18 21:59:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 721322d48755c911ec6c83cc2f4d974b SHA-1: 0209d2a497c2fb87a5bfc1f56e8ee1f56a917111 SHA-256: 13b5e5eb75d1a54a6651eab711d0286dd0883dfba761ecb6997b622d67f6d339
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains suspicious links, with one explicitly noted as an 'invisible link to suspicious domain' and another pointing to a domain associated with phishing. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware delivery. Although no scripts were directly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=mystery+method+audiobook PDF link annotation
    • https://xajovulunama.weebly.com/uploads/1/3/4/0/134096198/vitejedopo-mekupoga.pdfIn PDF document text
    • http://jusukigib.sportsontheweb.net/the_one_selection_series.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453908/normal_60184e8ce0b49.pdfIn PDF document text
    • https://xifobosakup.weebly.com/uploads/1/3/2/8/132815359/9d5ca23.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479678/normal_5fe27a46d2505.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454180/normal_5fd845cd1cec1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4423429/normal_5fe94b382522f.pdfIn PDF document text
    • https://jojapewabivato.weebly.com/uploads/1/3/1/3/131379205/minizodezogezin_pevesoxowokul.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455657/normal_604d075cc91bf.pdfIn PDF document text
    • http://rumurel.mywebcommunity.org/rigiwozepitizomamasoluv.pdfIn PDF document text
    • https://fevupadijedip.weebly.com/uploads/1/3/1/4/131407665/jajit_wawip_gapav.pdfIn PDF document text
    • http://waystep.site/limited_effects_theory_of_mass_communication_pptkkw8m.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417207/normal_5fd7f7ba6f9ea.pdfIn PDF document text
    • http://loginwithfb.site/97088292724eep3p.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408462/normal_5ffc9ebed8c40.pdfIn PDF document text
    • http://adanakebap.org/waxeduvereagm9f.pdfIn PDF document text
    • https://gikesusemu.weebly.com/uploads/1/3/4/7/134775173/33413415b39491.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tobobowu/jupajivekux.pdfIn PDF document text
    • https://s3.amazonaws.com/xozeb/batalowanezixuluvurokivox.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxalowafokuvo/convert_to_excel_sheet_free.pdfIn PDF document text
    • https://s3.amazonaws.com/wajibile/uefa_champions_league_theme_music.pdfIn PDF document text
    • https://s3.amazonaws.com/bejikefowu/senafarenesozitinigilu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d81e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD81E 5344 bytes
SHA-256: 06a772e0affecf963220a82971b5c16185537ada07e71f4096400f3fee5c0163
font_01_sfnt_off0000ea2d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA2D 10340 bytes
SHA-256: 6337b10517068d1b34fba479b6d54721248ba09fe3479c3a3d4b4bebc22bab9d

Open this report in the interactive analyzer, or submit your own file for analysis.