Malicious PDF — malware analysis report

Static analysis result for SHA-256 1acf51461f146f22…

MALICIOUS

PDF

77.9 KB Created: 2021-03-16 02:30:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 906f985bbf130260bc4441a77829f88c SHA-1: a162abe46e5a89722e632500c9de28b2083f35eb SHA-256: 1acf51461f146f220935683d0de2044872d8d5847db3cd70e592956ee8d1832d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing attempt to trick users into visiting a malicious website. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. No scripts were extracted, but the presence of the external URI is a high-priority indicator.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=chemistry+spring+final+review+answers
    • https://cdn-cms.f-static.net/uploads/4420030/normal_6022bd9429403.pdf
    • https://static.s123-cdn-static.com/uploads/4418991/normal_6000a4c0ecb4a.pdf
    • http://walkover.me/stephen_king_new_book_2019_reviewsztx7t.pdf
    • https://static.s123-cdn-static.com/uploads/4393019/normal_5ff634c04fd5c.pdf
    • http://dogolojowazovuf.iblogger.org/drunvalo_melchizedek_birth_of_a_new_humanity.pdf
    • https://cdn-cms.f-static.net/uploads/4445557/normal_601b27fcc85a1.pdf
    • http://bighome.space/gezovava20j60.pdf
    • http://bovosidifusu.iblogger.org/what_does_grantee_name_mean.pdf
    • https://cdn-cms.f-static.net/uploads/4484355/normal_604cbbb2488c2.pdf
    • http://dwatches.site/nowokoradanezhay7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/dd770f2d-b120-4fc4-9a26-c46d75867f54/98101380156.pdf
    • https://uploads.strikinglycdn.com/files/cbcd689b-c907-49f5-a310-1b5a3ef94683/bijupa.pdf
    • https://uploads.strikinglycdn.com/files/de907db7-0eae-4a17-b644-80cf9998d5bb/ruger_lcp_disassembly_cleaning.pdf
    • https://uploads.strikinglycdn.com/files/a9e714e2-1342-4687-ac26-f3e9329a1df0/first_aid_usmle_step_1_2019_ebook.pdf
    • https://uploads.strikinglycdn.com/files/22d17b68-4e1a-43f3-86f4-135a8946f99d/rosurum.pdf
    • http://kegogoxuxupi.rf.gd/physiotherapy_neurological_assessment_form.pdf
    • https://uploads.strikinglycdn.com/files/efba2033-a8f9-4715-94ef-ce5e8fe0ef11/digidesign_digi_002_firewire.pdf
    • https://uploads.strikinglycdn.com/files/d4552428-2cfb-45cb-aeac-7550bfc02992/max_lucado_church_service_today.pdf
    • https://uploads.strikinglycdn.com/files/25b7de33-d58b-4462-8fac-b67d8484a7f0/sexan.pdf
    • https://uploads.strikinglycdn.com/files/2bbe47f9-c07e-447a-acd2-8b83933e4b18/citizen_mens_eco-drive_titanium_watch_with_date_bm7170-53l.pdf
    • https://uploads.strikinglycdn.com/files/3449169f-4482-405e-8f70-c6b51fcbbdf1/pearson_edexcel_chemistry_book_1_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f04a.bin
f0ac8fd64263bc957866df8ce57a01f749b0c3a7fe303e58427be7a73c078bb1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF04A 5472 bytes
font_01_sfnt_off000102d7.bin
564081202153ac43c7b6a1ffeb5800f4593a362e7b0d26ddf92747cf32152295		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102D7 11544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.