Malicious PDF — malware analysis report

Static analysis result for SHA-256 150c37aa3820dd9c…

MALICIOUS

PDF

75.4 KB Created: 2020-12-16 23:24:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: c762c4036fc41d26e79f44bb507b01c9 SHA-1: 66e693f3badce1d759814aa4a15d2d90e0e787fd SHA-256: 150c37aa3820dd9c0555fc41b1079b871296623e1b649eaaec5d6eb866109783
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains an embedded URL that directs users to a suspicious domain, masquerading as a search result for a health-related topic. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. No scripts were extracted, but the presence of an external URI is a primary indicator of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/123?utm_term=why+is+mirena+recommended+for+mothers PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4367687/normal_5fbbb0506eec8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484399/normal_5fc2a12ba33f8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static1.squarespace.com/static/5fc5a3ecc14dfd36fe11d045/t/5fc8b6404b97230d051370ea/1606989377611/73060121159.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc19d720a2757459be7f0be/t/5fc9c0719bc93d20d9adecbe/1607057522287/snapple_lady_hocus_pocus.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc28637c89e1c4b8fc8d350/t/5fcaa34952c55e381a196d58/1607115594430/nail_designs_2020_coffin_fall.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc27e5df7cf8c754034f2c2/t/5fcf91ab509e863c6835cb55/1607438765122/tap_tap_fish_hack_apk.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe22271972c46e3c6829b3/1606296103573/meadows_season_pass_perks.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2adf9abaecd33182da937/t/5fca06ebacaba31734643370/1607075564317/28280127905.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf8ac9d104e5f152d739d/1606219951205/xelolane.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc583b0affbf90a6609c4d2/t/5fd10a267fb3605cf7b6011c/1607535142997/vegan_christmas_cake_recipe_gluten_free.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc657d6bdb33045eee7419e/t/5fc6c44ac953717e09c27310/1606861899056/empire_millennium_wars_online.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd05226a371610b8787d97/1606223140032/another_word_for_emotional_distress.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc651221c8c74131456d4a9/t/5fca946bad674710e4d1b51e/1607111788795/free_mobile_app_builder_site.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4bd9c77e-fcf1-4aa4-a5ba-b7cb74716d86/vadajojomowivakegokiduvak.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc3806ebd14ff0dd2ad09c5/t/5fc78de9efc65c5b7a46990c/1606913521494/check_cashing_store_near_me.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bda1a36d-1789-41a8-8ba4-6eaae47d84a8/photoscape_yeni_srm_trke_indir_gezginler.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6692c60f2895dc10d8c09/t/5fd65ebf481cfa31adc71baa/1607884483167/convert_outlook_contacts_to_excel_spreadsheet.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc55b0692c50b1a1e951dba/t/5fcb88e9a51c5a1401ab4f7a/1607174378327/muvaxatum.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db6e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB6E 5132 bytes
SHA-256: 78aadcfe69f87dc5018bf9f79a397cf02108fdd04d8fbe0d1e49f2b43a1a080e
font_01_sfnt_off0000ecb9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECB9 11088 bytes
SHA-256: 27e83189ed87cd9a8c1f88b3ee44f2890495da7916e919d3c2e3f41de9906db9
font_02_sfnt_off000111bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111BB 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.