Malicious PDF — malware analysis report

Static analysis result for SHA-256 19d4d0b47e4dfe82…

MALICIOUS

PDF

76.2 KB Created: 2021-03-14 05:21:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: aa33ba644376d703d7bcdd96563c2512 SHA-1: 4e6f31c7f4ab3ed3002e472b53bf84b69eb15622 SHA-256: 19d4d0b47e4dfe82430742bce47302960a1061a68c2d16d0f160f2a372f170d1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that directs users to a suspicious domain, likely for credential harvesting or malware distribution. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDF documents from web content, which aligns with a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=fishing+report+nj+lbi PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4379045/normal_5fca873c3a3bf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475734/normal_604b9fe58541f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371508/normal_601adf12d3536.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368962/normal_5ffeb993de69b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383131/normal_5fdc4f439e3bf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454045/normal_60490d0898981.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4448718/normal_5fffd13d15fbd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375077/normal_5fe74c888915d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nevovumowa/14921449585.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9dabdbc-2197-4b51-b092-b6f112461954/jawbone_up3_internet_connection_required.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5e70734-a753-49eb-97bf-3cd2543f5427/85747280620.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c73cddb1-9605-47f5-897e-db173110f14e/68392299913.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/893ca44c-8eea-4bab-9dce-58fb7beb757f/20703401829.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3db82164-36b0-40cb-a999-200a5dfea9af/canon_mp190_printer_how_to_scan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e982716-aa36-4e40-a23e-6335b71bf2dc/helter_skelter_1976_full_movie_online.pdfIn PDF document text
    • https://s3.amazonaws.com/gimisorixosu/51677781101.pdfIn PDF document text
    • https://s3.amazonaws.com/wajibile/2322778488.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b30e1721-b538-4555-8908-55f03a2fa748/zefozekoluru.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6d79531-5962-4c12-a0e8-947a6ab15b88/15034918752.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/54065458-6aef-428a-b3b5-685b354d9347/tipping_point_state_odds.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3587bef5-4b0c-4c88-8cc5-b447d6a8ba40/fakegifidomowoxifofepiw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3b877ea2-cbf0-4f04-adec-2243bd53b17a/biburubarabulubamilamet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e90eb20-0728-475f-a574-e6f57d32fdd0/zotogaxotojosaliruraf.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec63.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC63 5044 bytes
SHA-256: 8845557f34a2acc513c003c4776effaf3fa061247ed6de6cf134e2b11fc32412
font_01_sfnt_off0000fd8b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD8B 11144 bytes
SHA-256: 249f64e65ab0ea400bf136e83d9cc910e5e6633acaf9d54c797cf8af4e7c284c

Open this report in the interactive analyzer, or submit your own file for analysis.