Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a7562b35ddc9b16…

MALICIOUS

PDF

76.6 KB Created: 2021-03-26 07:31:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1e5c3d6920f840692021d53ea6b9dd96 SHA-1: b10820f6931b11dd11a600f800fb33c2bcc27742 SHA-256: 1a7562b35ddc9b16221b56bc716e317ec6f3d77d11189dd56fc66b81096753d8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing multiple embedded URLs, one of which is flagged as a high-risk indicator for phishing or malware distribution. The ML classifier and ClamAV detection strongly suggest malicious intent. The document body, though heavily obfuscated, contains references to medical treatment, likely serving as a lure to entice users to click on the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=amoebic+liver+abscess+treatment+pdf
    • http://gajaxujifusokul.mygamesonline.org/panasonic_viera_50_inch_plasma_tv_weight.pdf
    • https://fubediko.weebly.com/uploads/1/3/1/0/131070718/7484890.pdf
    • http://xubajur.mygamesonline.org/tutorial_basico_sketchup_make_2017_carpinteria.pdf
    • https://cdn-cms.f-static.net/uploads/4493888/normal_6034ec307e2d4.pdf
    • http://youralteragoods.com/bluegrass_songbookq311b.pdf
    • http://nenodipemuxok.mypressonline.com/petowezu.pdf
    • https://mijebekebune.weebly.com/uploads/1/3/4/0/134017127/dapazixakamasiveku.pdf
    • https://pafegesufo.weebly.com/uploads/1/3/4/7/134719460/1634462.pdf
    • http://fofiwafajelerax.sportsontheweb.net/farojasumatoxosoloka.pdf
    • http://plusstore.pro/river_flows_in_you_virtual_piano_sheet4frb9.pdf
    • http://ledimpress.biz/critical_thinking_the_art_of_argumentk7uhl.pdf
    • http://juvizex.sportsontheweb.net/resident_evil_7_biohazard_guide.pdf
    • http://infonewsuk.site/edius_6_free_download_full_version_with_crack_32_bitpcp44.pdf
    • http://rozujed.sportsontheweb.net/tascam_dp_24_review.pdf
    • http://zegiwire.sportsontheweb.net/the_lottery_book_review.pdf
    • http://sewonmedix.ru/sims_3_cc_folder685uu.pdf
    • https://cdn-cms.f-static.net/uploads/4445735/normal_6050b7566ec24.pdf
    • http://niburufajanuto.sportsontheweb.net/acls_manual_2015_free_download.pdf
    • http://taforojujutusig.mygamesonline.org/18393938482.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://liroporuki.myartsonline.com/jirejotizubidemozawumafuk.pdf
    • http://bebojivim.myartsonline.com/70566592043.pdf
    • http://fidikaxano.myartsonline.com/rafitabi.pdf
    • http://manosotidokef.myartsonline.com/zupezabuwawadufe.pdf
    • http://kosezofejesuxef.atwebpages.com/tugej.pdf
    • http://kuwijiti.myartsonline.com/how_to_hide_caller_id_on_your_phone.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef00.bin
132da9a9d3d4ac5928ebe62b0e75271d2f10e12cabfb2f31398474a5cd072aa4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF00 5488 bytes
font_01_sfnt_off00010199.bin
02e47d684d2a947188c1f52ebd5fb5c0b4a414c945e073fdd1adbda32bf403cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10199 10300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.