Malicious PDF — malware analysis report

Static analysis result for SHA-256 13b6e41bb7575d04…

MALICIOUS

PDF

94.7 KB Created: 2021-03-16 20:44:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: e1f0d75697d69e345f244bc05211d8bf SHA-1: a293975cc904d849430b87fe0389250e06d832e3 SHA-256: 13b6e41bb7575d040c59f28dfa1e5bee5c18d269373a008032ef29de8f0180a2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL points to a suspicious domain, likely used for phishing or credential harvesting. The PDF structure and embedded content suggest it's designed to trick users into visiting this external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=concept+of+skewness+and+kurtosis+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4383136/normal_602a4f4ee51ce.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406481/normal_6009eeaf23385.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366666/normal_5febb673d979d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4469101/normal_6006c68fef436.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393751/normal_5fcf3bd6c9d8a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486363/normal_600ea17e60ed0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4388596/normal_5fde2348196e3.pdfIn PDF document text
    • http://damapilob.iblogger.org/74029592120.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481053/normal_5ff28d2976932.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387410/normal_6044fbf3e1783.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371272/normal_6002b0d639b68.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392647/normal_604ba6acd2a6b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b748afe2-ad79-4b5a-823e-4a9afcbb28cd/wusidivo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a173de5-1173-4ae8-98af-f92cbf6f4e22/faxafotutifim.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/396616df-2cde-4678-8c9e-c795a65db73a/wireless_bluetooth_adapter_for_beats_solo_2_headphones.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2c33928-a2a6-4bb1-9a5e-2605a3e47eaf/lomuza.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c41f65d-52d7-4b68-8a53-0285cca8f96c/15608572296.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/79646bfe-3a2a-4bed-aede-3ed337f14c5b/how_to_determine_volume_of_cylinder_in_gallons.pdfIn PDF document text
    • http://butukekijefe.epizy.com/surah_yaseen_dua.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4e31d1b-bb26-4058-9dd5-c53611c2a1ae/nusuxukezujezazob.pdfIn PDF document text
    • http://pifaramurul.rf.gd/28436064961.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b7ecf29-2e09-4158-b072-a9cd579d93a8/wedeka.pdfIn PDF document text
    • http://wakurenup.epizy.com/zetaforolatitoweti.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e5f539c-7750-4b12-b19f-db3f08eae44d/wowizefofir.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97bde8a4-350d-4bdd-9866-c9863be5312b/garmin_vivo_3_user_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012c8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C8E 5180 bytes
SHA-256: 0d9ed57d3d63d591214222f7378677b16c9e7ccafe9c9cbd426cb00dc0eb32df
font_01_sfnt_off00013e54.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13E54 13972 bytes
SHA-256: 80a560f86f9d3de470a652fd86f43c60d63c4023917233a8cba407a190487c4a

Open this report in the interactive analyzer, or submit your own file for analysis.