Malicious PDF — malware analysis report

Static analysis result for SHA-256 16c147125af8b2fa…

MALICIOUS

PDF

73.9 KB Created: 2021-05-14 15:23:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5c9c9e13027a9a4c5a6739b41e82c06d SHA-1: 23a1083a728e02fa217bbc1968ab86c558f0f9c9 SHA-256: 16c147125af8b2fa1eebbee262e1dba3a26424322247f5e779183cb76402c186
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains embedded URLs, one of which points to a suspicious PDF file. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution. The embedded URLs suggest the document is part of a campaign to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pyhm.ca/wp-content/plugins/super-forms/uploads/php/files/t3e4966l5clajgvbg584ms93ar/dezurilepa.pdf
    • https://suhrsmad.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1607c684537dbd---8608297325.pdf
    • http://salonlomi.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16073980f8a233---60600811751.pdf
    • http://www.skup.it/wp-content/plugins/formcraft/file-upload/server/content/files/1609498aadd53f---54076478543.pdf
    • http://fabrykakonwersji.pl/wp-content/plugins/super-forms/uploads/php/files/7b0f37a789d9e766fdb62d97862ed0c6/judoloxolipugibekukavek.pdf
    • http://lichnyiybrand.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160985c200e464---38837515123.pdf
    • https://www.bountyvacation.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ca2ecbfb58---70719541389.pdf
    • http://crmrealty360degree.in/userfiles/file/71965775005.pdf
    • http://suamayin.biz/userfiles/file/85369470926.pdf
    • https://www.financedeclined.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160828b7586268---retigofemo.pdf
    • https://www.ideaklinik.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1607e7f3a3d071---22149830574.pdf
    • https://luxmarketing.agency/wp-content/plugins/super-forms/uploads/php/files/2obdtfnd1n9ge0iu9f7p0fnk05/xifup.pdf
    • https://beribuket.ru/wp-content/plugins/super-forms/uploads/php/files/934493bcf9cb963752c2497283f704cf/govuwotowituz.pdf
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/rfvgi1cbbi2tt2mi932aqriptc/28674088858.pdf
    • https://rybczewice.pl/userfiles/file/12940844995.pdf
    • http://rethabise.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16075e24d5395a---wugup.pdf
    • https://www.getfitcrew.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a3b09dde62---mufelirijonurit.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/PmAiG5ZyT-k/uplcv?utm_term=super+n64+emulator++apk
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e483.bin
1b0f143abcc98b4c60b00a90969123a3373f24271af361486adf1248775f2ccd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE483 5196 bytes
font_01_sfnt_off0000f61d.bin
00b500ba77e1cb5a4049b1c2ba3fc81afac28f6de7b01ebc0737dec3d6f2fb30		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF61D 10812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.