Malicious PDF — malware analysis report

Static analysis result for SHA-256 13d525fa9b71fae8…

MALICIOUS

PDF

84.4 KB Created: 2021-06-25 15:42:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: a2175a23aa8b77e9be41d2db09439669 SHA-1: 0caa4f5e9ba40fc73c70169bbe92a88709ee944b SHA-256: 13d525fa9b71fae85ff750c1cb93afbe8f1bd3f566934c807decd940512f8633
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains an embedded URI that masquerades as a search result for "dawson county courthouse", likely to trick users into visiting a malicious site. ClamAV and ML classifiers also flagged this file as malicious, indicating a high probability of phishing or malware distribution. No scripts were extracted, but the presence of external URLs suggests a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://huntic.ru/uplcv?utm_term=dawson+county+courthouse
    • http://artospace.com/pics/file/dusikuwifi.pdf
    • https://hzautomatisering.nl/userfiles/file/pokide.pdf
    • http://www.canadiantreasurer.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081ca786b3b3---93079565147.pdf
    • https://40parables.com/wp-content/plugins/super-forms/uploads/php/files/d0a7c395bf89af4560a86e15df200374/mirebipivokarogatuwefimit.pdf
    • http://gsoam.ge/wp-content/plugins/formcraft/file-upload/server/content/files/1608090800c236---wuzebewiteginosejofev.pdf
    • https://sakitonus.ru/wp-content/plugins/super-forms/uploads/php/files/68e61c6a37085964a1cc154ad91d9b20/lojitojimovaripafijepu.pdf
    • https://www.guestquesttravelmedia.com/wp-content/plugins/super-forms/uploads/php/files/nclp1vr1pai67c336ag1mio7e8/bagupi.pdf
    • http://thongthien.vn/upload/files/10303075485.pdf
    • https://smarttactic.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160c6ffc45dc5f---debejepemu.pdf
    • http://win-sonic.com/kida2018/ck_imgs/files/65116574676.pdf
    • https://riverasphotovideo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071d990950db---pamorutuma.pdf
    • https://webtraffic.ch/wp-content/plugins/super-forms/uploads/php/files/ashclmsefo4hfnihgduoucknfv/rufuliwumuruvitom.pdf
    • http://j1medical.com/uploaded/file/jemafuxise.pdf
    • http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/16080ca4b18f67---94734576554.pdf
    • http://foire-fromages-et-vins.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c1f443cd5d0---80964292839.pdf
    • https://micast.de/wp-content/plugins/super-forms/uploads/php/files/mga8hjfe7n6s7f6s9igjob5gbt/22867144058.pdf
    • http://auxerretv.com/content/public/file/86516136894.pdf
    • http://mdbim.pl/ubezpiecz/obrazy/file/24644850138.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e779.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE779 16792 bytes
font_01_sfnt_off0000ff90.bin
09364aee913be15c9aff207e29b144ea03ad8e4c58b563572a6c4bea24925d17		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF90 10488 bytes
font_02_sfnt_off00011780.bin
c68f8b81d213a68844bb089869a4beec4df280f2e8dc0422c52cb5c650f8a3e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11780 17300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.