Malicious PDF — malware analysis report

Static analysis result for SHA-256 160daff6062d9245…

MALICIOUS

PDF

75.7 KB Created: 2021-03-11 16:54:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: e256a88a1b79ae54485384097d47bd60 SHA-1: 71cec6236c27d0da4e2943f305b2c01aec8b900c SHA-256: 160daff6062d9245bb7f665d2af6368cf0f41a307134672ad67945426728aed8
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, indicating a phishing or malware delivery attempt. The document body, though heavily obfuscated, contains text related to Amazon Prime shipping, suggesting a lure to trick users into clicking the malicious link. The ML classifier and ClamAV detection strongly support the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=why+is+amazon+prime+no+longer+2+day+shipping In PDF document text
    • http://podarokinsta.site/aiag_msa_reference_manual_4th_edition5czx4.pdfIn PDF document text
    • https://cdn.sqhk.co/gonolesuzam/aIhbJvO/pulsera_smart_samsung_galaxy_fit_lite.pdfIn PDF document text
    • http://slamelina.website/23291049875rry0b.pdfIn PDF document text
    • https://cdn.sqhk.co/kosaboze/d9L8ie4/taxus.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xenavuxa/68275417621.pdfIn PDF document text
    • https://s3.amazonaws.com/xapota/mefewaxonos.pdfIn PDF document text
    • https://s3.amazonaws.com/tawosutosuxi/weduri.pdfIn PDF document text
    • https://s3.amazonaws.com/bidemewufa/matched_ally_condie_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bedc9d3f-7e6f-40fe-81e2-718e2cb8a28b/kivogenumegamasuwele.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/46e13d1e-dc69-4ab1-9735-c5dd127fc1ae/xewurobibarifit.pdfIn PDF document text
    • https://s3.amazonaws.com/wozowuledij/zapijodori.pdfIn PDF document text
    • https://s3.amazonaws.com/bokelur/kiwafawifusobaba.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3eab193-c79b-4473-9a8b-32d8e1bfe9a4/38774588482.pdfIn PDF document text
    • https://s3.amazonaws.com/waxegatulo/android_google_play_store_not_working.pdfIn PDF document text
    • https://s3.amazonaws.com/jaloto/kamus_bahasa_arab-_indonesia_per_kalimat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/568a21e4-d1f9-42ca-b87e-5c3d06a6a500/58430139989.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ed3c9ec-95b1-4ff8-97ef-4429aad9b9f6/70915651395.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c6899c3-c7e8-4efd-b1ec-b1d2af89e091/dixie_chopper_lawn_mower_prices.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eafc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAFC 5672 bytes
SHA-256: 702becde4c367af9af7c4af8f9c632c6b4426ff438db7cb9e730dcabc66dccdc
font_01_sfnt_off0000fe37.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE37 10416 bytes
SHA-256: 6aff8c2419e5a5ca3f1b8d9818c2035bdadf4ff54544f3793e0c7ad7757500e2

Open this report in the interactive analyzer, or submit your own file for analysis.