Malicious PDF — malware analysis report

Static analysis result for SHA-256 198881d8a4db729d…

MALICIOUS

PDF

74.2 KB Created: 2021-03-28 09:06:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a5a93ab66cea396e8a609d24b9c63fd2 SHA-1: d3a2d33d77a82794650bb4ffd8843447542fb26b SHA-256: 198881d8a4db729dc2a769a1c663973711e3dddafef500ca79764f007f23a122
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV. It contains an embedded URL that leads to a suspicious domain, likely intended to host phishing content or malware. The document body, though heavily obfuscated, suggests a lure related to 'guyabano leaf tea'. No scripts were extracted, but the presence of an external URI and the overall detection indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=how+to+make+guyabano+leaf+tea
    • https://cdn-cms.f-static.net/uploads/4474465/normal_60447411b59f6.pdf
    • https://cdn-cms.f-static.net/uploads/4447431/normal_605198fcb921b.pdf
    • https://static.s123-cdn-static.com/uploads/4484363/normal_6005fb8b6afde.pdf
    • https://cdn-cms.f-static.net/uploads/4448113/normal_6040a3a87328f.pdf
    • https://static.s123-cdn-static.com/uploads/4454803/normal_5fc9cc171c79e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/c902f898-b4d4-42cd-b269-ad967de104c2/operations_manager_salary_in_amazon_india.pdf
    • https://uploads.strikinglycdn.com/files/de60e285-7964-42bb-bb15-c87ede5fc6e6/vuwilagabevemuxesose.pdf
    • https://uploads.strikinglycdn.com/files/7c425be4-f414-4795-ac9d-e46c6ef45f52/85613526897.pdf
    • https://uploads.strikinglycdn.com/files/7782da13-987b-46ec-83ec-71e269b2e649/mafaxo.pdf
    • https://uploads.strikinglycdn.com/files/bf36d3bf-c467-4a65-ae60-1b29ccd8c714/how_to_find_merit_badge_counselors_on_scoutbook.pdf
    • https://uploads.strikinglycdn.com/files/aca149ba-7b1e-42b4-bdfb-1471e97e418c/vogeparusidewi.pdf
    • https://uploads.strikinglycdn.com/files/0d151050-ed4b-46b5-a439-94cff1f18cf0/how_is_paid_leave_calculated.pdf
    • https://uploads.strikinglycdn.com/files/72f5b189-657d-4b80-b98d-621117b9ef14/vatebedakefinexuzaxevuwi.pdf
    • https://uploads.strikinglycdn.com/files/0d0a99fe-c5b2-47bd-96f4-6277c1ed3ac3/biblia_reina_valera_1909.pdf
    • https://uploads.strikinglycdn.com/files/b113067a-de10-4490-be89-98fa0ef286b2/mofewuvurovuma.pdf
    • https://uploads.strikinglycdn.com/files/38a81730-bfbe-458b-bcff-5d642d90b0f3/bulajudorulof.pdf
    • https://s3.amazonaws.com/kubedukowug/fifty_shades_of_grey_audiobook_free_download.pdf
    • https://s3.amazonaws.com/rumezo/96911100263.pdf
    • https://uploads.strikinglycdn.com/files/ba04db99-aa39-421a-870f-ba8bb21691aa/focusrite_control_3.5.0_download.pdf
    • https://uploads.strikinglycdn.com/files/bd8c80f1-97ed-4ec4-9af4-7a60344bd146/how_do_mountain_lions_adapt_to_their_habitat.pdf
    • https://uploads.strikinglycdn.com/files/38b38161-0ffb-4c77-b438-8b044ad36e94/77049468548.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e485.bin
939448e67dc6ca90468a0fdaa2d18b1dc168f6ad55b6cddf3b7b5685abbc1ca8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE485 5172 bytes
font_01_sfnt_off0000f631.bin
8bcb547b26ca1160639d9c04b1561689a026f6f5c8c82ee3994a45c1cad25580		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF631 10808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.