Malicious PDF — malware analysis report

Static analysis result for SHA-256 14176458725409c3…

MALICIOUS

PDF

74.1 KB Created: 2021-02-15 19:19:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: e687965c9fe8594cf15499d471251657 SHA-1: 97c9e1f56b3401d3e548d01f1eb86ceb6d32581d SHA-256: 14176458725409c35ad6f443a610b796e64b1deb6d4d54cb6825253357075ae7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to a suspicious domain, which is likely used to deliver a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to 'oven parts', which is a common tactic for phishing or scam campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=ge+spectra+electric+oven+parts PDF link annotation
    • https://cdn.sqhk.co/pabelewexo/jfnTiie/77975132907.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369330/normal_5fc99507edaf6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443801/normal_60161d2cc0c5b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417664/normal_5ffd80749ff1f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457843/normal_600c4ffb782fa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465262/normal_6000c9f61f451.pdfIn PDF document text
    • https://cdn.sqhk.co/dojarodawiw/jPgf9iw/zomobozex.pdfIn PDF document text
    • http://onesmall.space/17461628997zb80d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4411246/normal_5fced107122ee.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4529780/normal_5fc6a3e282190.pdfIn PDF document text
    • http://znakomstva18x.site/nosatazupaswi55.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366354/normal_600eb1973d12b.pdfIn PDF document text
    • https://cdn.sqhk.co/sawowudin/hb2hhha/the_joker_hd_wallpaper_2019.pdfIn PDF document text
    • http://center-about.com/jntuh_r13_percentage_calculator55npa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385410/normal_5ffad00368f95.pdfIn PDF document text
    • https://cdn.sqhk.co/notizejamebo/Mhf5tjd/7653290629.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/lukepepe/girl_guide_cookies_canada_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/fokapikow/2017_kia_sedona_lx_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/jarawaxanivu/3287492561.pdfIn PDF document text
    • https://s3.amazonaws.com/mogedozara/video_helper_opera_extension.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e32a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE32A 5016 bytes
SHA-256: db617e4fb2fce0c9428a26a0eff41e8b5b204a6a687d17615463878c8d69aba4
font_01_sfnt_off0000f454.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF454 11460 bytes
SHA-256: 66750f62afb733c87c28e61bd1c0bf35e8b36d41b63af9644875a678f134a941

Open this report in the interactive analyzer, or submit your own file for analysis.