Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b87f674f7c5c9ff…

MALICIOUS

PDF

73.0 KB Created: 2021-05-13 05:01:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c652fadb96a03121393353741acca217 SHA-1: 9ad55d0cdd8d5ed2bd264762fb7f175885a21c5c SHA-256: 1b87f674f7c5c9ffacfe3828f23c123ac5bc4360fe45b4a5a3c6dacfbdb37474
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI that points to a URL which, while currently marked as benign, is likely part of a phishing or malware distribution scheme. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of external links and the overall detection suggest it's designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.mclarenpress.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609bb3e6cbb65---55496130223.pdf
    • https://spherule.org/wp-content/plugins/super-forms/uploads/php/files/fdf72e97821cff210f3bfd767a1f67bb/nejivububazudufel.pdf
    • https://leesman.com/wp-content/plugins/super-forms/uploads/php/files/36ee3f9d39666ad621d7db4b8c81848b/lumubasigoguve.pdf
    • https://dmddsgn.com/wp-content/plugins/super-forms/uploads/php/files/e4c5f904a9f8caf0e70b98d6e483a507/nimuvitewesoguwoti.pdf
    • https://ncfouting.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089096a89b15---21600713943.pdf
    • https://shared401k.com/wp-content/plugins/super-forms/uploads/php/files/b9b79b40f8bb28de5541a4c7557783c8/1029510704.pdf
    • http://www.goataxiservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607082e6532cf---lotamitefosisudosojixiput.pdf
    • https://alakharia.com/public_html/userfiles/file/vevawumarak.pdf
    • http://aksaxena.com/bpms/includes/fckeditor_uploads/userfiles/file/34872000255.pdf
    • http://www.nowsingapore.co.id/wp-content/plugins/formcraft/file-upload/server/content/files/16082834b6a749---rodovexipotarip.pdf
    • https://www.sgestrecho.es/wp-content/plugins/formcraft/file-upload/server/content/files/1606d80d127f3e---gugujeledoxudarejonu.pdf
    • https://www.sharpeningfactory.com/wp-content/plugins/formcraft/file-upload/server/content/files/160701b27a743a---zumenizejeronuno.pdf
    • http://phillipwhiting.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606fa43df2241---gipepuzesoxotekuvekapuk.pdf
    • https://www.sussexweddingservices.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160865f826b427---kojomule.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/PmAiG5ZyT-k/uplcv?utm_term=carte+blanche+dj+snake
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0f9.bin
810f4231eacbebf6ba2ae5e6e4552374504da39dba29d379d61c5890bea8a41c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD0F9 3432 bytes
font_01_sfnt_off0000dd46.bin
03bc83b48ee0c405bdfd65feed7647a34dede7e3798b473a7907d6a0e8aece32		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD46 5212 bytes
font_02_sfnt_off0000eef2.bin
3a7ef8e14c61a6baa94e181a8f84f969e2c868d6246bf12ff2f35520a4e9094f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEF2 11948 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.