Malicious PDF — malware analysis report

Static analysis result for SHA-256 158215f1860bdfd1…

MALICIOUS

PDF

79.2 KB Created: 2021-05-25 00:05:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: ddec7dd4e6a5fddc7791740001d3b9ea SHA-1: b3a9cba54544c770ac47bfc9577c5d632709cdd3 SHA-256: 158215f1860bdfd16753c57fdf573d0d14995c7b9d5cc551209ab86db2056560
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to a suspicious domain, likely intended for phishing or malware delivery. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=vertical+line+test+practice+worksheet+answers PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4470542/normal_5fc79b83a0b36.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449618/normal_6042f5bdcc763.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387711/normal_5ff0073ea2882.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/722c4461-c2ac-4067-aa78-5551d57323aa/aircare_humidifier_ma0800_instructions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e800176-5955-4871-9d5c-7cff6839f3cc/best_buy_geek_squad_protection_laptop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/825d0703-d5fa-44fb-9ed1-94c89425f7c2/how_many_calories_in_a_small_iced_coffee_with_almond_milk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56fa12aa-3bff-40e6-89e4-bc17c3efeabf/68898731611.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/26d6163f-99d4-497e-b729-2c021f52e5c9/does_kidney_failure_cause_metabolic_acidosis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30f19e83-4483-40d7-b59d-cc874156bff6/54707037651.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fd6a4c55-20eb-4958-a27e-74b0b69c16a6/how_much_do_biomedical_engineers_make_in_florida.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/85e22218-1709-4b1d-aa63-098e166d653f/how_do_i_flush_my_heating_system.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff1167d6-f471-4557-9b75-d8303d170226/28632964872.pdfIn PDF document text
    • https://s3.amazonaws.com/kizugokofo/sample_resume_of_network_security_engineer.pdfIn PDF document text
    • https://s3.amazonaws.com/kufazete/geposolupufigapef.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9877a751-d120-4893-ba88-392825ce3ad9/37590296255.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/242efa05-eccf-4e44-9f91-842ec90ca28f/nusumaje.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/78b37789-a631-4770-b1a3-bfcaad4c7486/how_do_you_board_a_ship_in_assassins_creed_odyssey.pdfIn PDF document text
    • https://s3.amazonaws.com/vigevot/garmin_2589_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c89bab1d-a20e-4ea0-845b-b067d4bb1f8e/69637958019.pdfIn PDF document text
    • https://s3.amazonaws.com/wajufifenoxuj/retexisagolifef.pdfIn PDF document text
    • https://s3.amazonaws.com/sojenozap/vpn_android_2._2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80597050-838e-4e1e-8732-4e5755b76265/determine_the_coordinates_of_the_centroid_of_the_shaded_area_xky2.pdfIn PDF document text
    • https://s3.amazonaws.com/zufaxepixiguxax/how_to_ace_calculus_the_streetwise_guide_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a1e1c16-5f3b-4138-9b3b-64a0e5423e74/3225827145.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2F3 5140 bytes
SHA-256: 07c416cf8da126f27ac0ea7e78c6613b224562db3c64964c4f4278af3df853f0
font_01_sfnt_off0001047e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1047E 12952 bytes
SHA-256: ccb5c9f9d3ecacd73bf522fd33577a9292b438a6d9f1359d228595f5507bc9b2

Open this report in the interactive analyzer, or submit your own file for analysis.