Malicious PDF — malware analysis report

Static analysis result for SHA-256 18febe83eea249a1…

MALICIOUS

PDF

86.0 KB Created: 2021-06-28 03:00:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 84e453a34a47383f19f12d68acc600d8 SHA-1: bf26a1d9cee9af7eed30d91f736ced368a64bb06 SHA-256: 18febe83eea249a1cfcef95004be2b9408dd7dc29d6ee5371d62210812e168bc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that points to a suspicious domain, identified by ClamAV and ML classifiers as malicious. The presence of external URIs and the ML detection strongly suggest a phishing or malware distribution attempt. No scripts were extracted, but the embedded URI is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9952

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/uplcv?utm_term=dog+with+different+colored+eyes+myth
    • https://www.ergunaygoren.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d924bebb4c---46851133875.pdf
    • http://www.caslyn.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160b73b1f183b8---lozagozina.pdf
    • http://cargo3030.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1608e6e01a88ca---27805518916.pdf
    • http://www.stallionreadymix.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160795f2941af9---tejowanerexezu.pdf
    • http://famcareconnect.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607ed1b47da46---vapegatutefevogabe.pdf
    • http://theopenhouseclub.com/wp-content/plugins/super-forms/uploads/php/files/1585b87902276f2c950af28fc7096459/19586140159.pdf
    • http://www.nbrownies.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160705190a6056---96237344289.pdf
    • https://medosojewellery.com/userfiles/files/38495130181.pdf
    • https://mosoptagro.ru/wp-content/plugins/super-forms/uploads/php/files/8d726d629a865ba9ee051637dbdcbc33/68666297312.pdf
    • https://akrmedia.no/ckfinder/userfiles/files/bajukekagimiko.pdf
    • https://fenixfalt.com/userfiles/file/vufiroxofigedumonorijil.pdf
    • https://123kozijnofferte.nl/wp-content/plugins/super-forms/uploads/php/files/ocsrmgvgsghj7pk5npolai80i1/xefowaletofisuxasetikosaf.pdf
    • https://law.com.sg/wp-content/plugins/super-forms/uploads/php/files/c0202fb8f7496a030c37c1bc63c760e7/67418563052.pdf
    • https://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160bc614d15019---tagajovukivarusepamofoxo.pdf
    • https://hoffmanowska.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1609117ce3b873---40231201483.pdf
    • https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b29d229cb06---tuxisavifat.pdf
    • https://www.tessilgiada.it/wp-content/plugins/formcraft/file-upload/server/content/files/16070e27ccf8dd---12208514715.pdf
    • https://bykevin.com/wp-content/plugins/super-forms/uploads/php/files/8fb525c3bba664820a89abff9244474c/25469120202.pdf
    • http://slanfusa.org/clients/47225/File/tukamitutuvegi.pdf
    • http://allnatureint.com/userfiles/file/87219784072.pdf
    • http://chocolatycakes.com/wp-content/plugins/formcraft/file-upload/server/content/files/160780afa27fb0---kulupuzenop.pdf
    • http://ingenermarket.ru/userfiles/puzanunimikevafik.pdf
    • https://memoservicesrl.it/file/bupozatiseforejosadatozuf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee04.bin
55660bf328b7da90ab354f263c636f541ce08e234de7b55a9ea50be6e083be55		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE04 16812 bytes
font_01_sfnt_off000119a2.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x119A2 16792 bytes
font_02_sfnt_off000131b9.bin
08ee307dec229a6a71de2b8ffa2d3e757b1a64b46a531f81f1cd7c0d78bc4e72		 pdf-font-stream PDF embedded font (sfnt) at offset 0x131B9 10960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.