Malicious PDF — malware analysis report

Static analysis result for SHA-256 197b700a2f51d936…

MALICIOUS

PDF

87.8 KB Created: 2021-05-24 12:00:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 017c973c81b583daa1dbe166f3db1394 SHA-1: c53afa0d53e04812c9b11d14fbab5f94b8026505 SHA-256: 197b700a2f51d9368b0c6a49e92f07e6825512626d2dcdd41c13cbbf73d96ec2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains embedded URLs pointing to external resources, suggesting it's designed to redirect users to potentially harmful websites. The presence of PDF-specific heuristics and the nature of the embedded URLs point towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.northernillumination.com/wp-content/plugins/super-forms/uploads/php/files/2c5b079a29d81e1fec1f63e20f5e2a31/gavokujugozavabumopixuk.pdf
    • https://www.landalastadservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b68ce44710---nokokirukemum.pdf
    • https://www.hotwaterfactory.com.au/wp-content/plugins/super-forms/uploads/php/files/020a3c1269b5aea4d27070d7be1dfb05/59504626689.pdf
    • http://english-island.pl/wp-content/plugins/super-forms/uploads/php/files/3rjiguetgmmaj52fek2a6ifmt0/75698743938.pdf
    • http://pulsrmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/16099cb2936ae7---majirofuwonefa.pdf
    • https://rjiminfra.com/wp-content/plugins/super-forms/uploads/php/files/6c50cd8ba277fdc2342d2a61ba73eef4/dipefofogujifolu.pdf
    • http://bfr-bialapodlaska.pl/userfiles/file/lelewegetetotif.pdf
    • https://joyfool.art/wp-content/plugins/super-forms/uploads/php/files/a41539b7a45234e1f998fcecd38f914d/tepurofusifoxegek.pdf
    • https://malimbe.africa/wp-content/plugins/super-forms/uploads/php/files/cc51007e132a3b19b25c1bec9b88a2ab/94152381898.pdf
    • https://eliteswimmingpoolsinc.com/wp-content/plugins/super-forms/uploads/php/files/7enleqmesq8luibsrepg360th7/95947995574.pdf
    • http://alexanderkanevskyartistbiography.com/clientMedia/file/46863877154.pdf
    • http://xn--80ackbssfuieecff0e8c.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/0560vjsabq2aeucaki44fq96e3/30978165250.pdf
    • https://www.americanapi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083de72d9c71---31968233086.pdf
    • https://wacee.net/wp-content/plugins/formcraft/file-upload/server/content/files/1607de871da2d2---65881535612.pdf
    • https://deedpoll.sg/wp-content/plugins/super-forms/uploads/php/files/fed6f3d88ac0165be6e6d751925fd7ad/sakusifumowasex.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/skout/mBVl/~3/FevRqgeaUVY/uplcv?utm_term=competitive+maths+pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010184.bin
b1dfcff6ccff5bcc5524b6b91ba534f3a1712dced14dd8176c63269475c48a4a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10184 5116 bytes
font_01_sfnt_off000112ca.bin
a1f30d4ce8dab7d4230a599c85bbde50af3c8b8c6dd818ce606e30414d9c952e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112CA 12600 bytes
font_02_sfnt_off00013d8f.bin
f3b752e25d2e3098dc5b351a512c5ca672d2b137fcb7ddb3f81b2384be51d5c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D8F 16072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.