Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a84648ad0347938…

MALICIOUS

PDF

72.9 KB Created: 2021-03-24 08:02:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 0dc1a13394a3f176dc44ffec776e5046 SHA-1: be9a3af65d0b07daf08eddeec8f0ce31580f403a SHA-256: 1a84648ad0347938fa243da5a7f46d1fff9a53f77af2df1c16e4963202c2a655
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious download or phishing page. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDFs from web content, further supporting the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=lokmat+newspaper+aurangabad+pdf+download PDF link annotation
    • http://soinjaga.ru/908151654251prdv.pdfIn PDF document text
    • http://mugedly.xyz/what_is_the_weight_of_diesel_fuelwhqk5.pdfIn PDF document text
    • http://nebo-baikala.ru/objetivos_y_subjetivos_de_la_contabilidad_de_costoslfpnm.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/girilifawuxi/basic_bookkeeping_spreadsheet_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a1aca729-c92f-43f3-9634-3db6d5eceabb/xomutofibovegitusomud.pdfIn PDF document text
    • https://s3.amazonaws.com/xafaxotaful/safixikijaned.pdfIn PDF document text
    • http://rudemunipa.epizy.com/kidde_smoke_detector_beeps_once.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b84ae8c-ab06-43f3-8627-63c0253f2232/dyson_animal_hoover_cordless.pdfIn PDF document text
    • http://nokezipaxizowox.epizy.com/nanonegiwusozewa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b38f98a5-d4ac-4fef-8d4d-98883ca891ca/artemis_fowl_trailer_2_song.pdfIn PDF document text
    • https://s3.amazonaws.com/fuvidokibet/craftsman_rear_tine_rototiller_for_sale.pdfIn PDF document text
    • http://mizixizomafupez.epizy.com/83827036606.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e076a89a-37f5-477f-8285-258316d2c75c/18383725700.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de04dbc3-062b-4810-974b-fb2673045de5/ccna_routing_and_switching_200-125_book.pdfIn PDF document text
    • https://s3.amazonaws.com/jefazaxal/fuzerajolofuzisimag.pdfIn PDF document text
    • https://s3.amazonaws.com/nemafu/dibujos_para_imprimir_y_colorear_frozen.pdfIn PDF document text
    • https://s3.amazonaws.com/megodipewukitoj/zipigigetapenusi.pdfIn PDF document text
    • https://s3.amazonaws.com/kufazete/ccavenue_payment_gateway_integration_in_android_studio.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6961afb0-7451-452c-8402-053fff88533c/a_little_life_hanya_yanagihara_epub_vk.pdfIn PDF document text
    • https://s3.amazonaws.com/xijalovelokolep/benefits_of_information_technology_in_healthcare.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/275f9e54-84f9-40b7-8644-f2fee18275f7/toyota_camry_xle_v6_for_sale.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD1B5 5432 bytes
SHA-256: 8f1ce7ea950faa419f6d256bea6ad56905b6196dd8bb95e7f6d31041f09c5bc2
font_01_sfnt_off0000e422.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE422 10880 bytes
SHA-256: 41509b526fc7f7bcc804096ab1e1e7ed016159ca32466ff144f2d75dfc3699a6
font_02_sfnt_off0001081a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1081A 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.