Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b9693eba8058639…

MALICIOUS

PDF

84.0 KB Created: 2021-07-03 18:00:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 4a75f372d5bdc9cdd3812d2dec420672 SHA-1: 7146558564be9d4f2f3923bb356b9c22a85218f3 SHA-256: 1b9693eba8058639e81b13fa5cb7170f6ad10c2b040ef2924cc548a612e2c359
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF file flagged as malicious by ML classifiers and ClamAV. It contains multiple embedded URLs, many of which point to other PDF files, suggesting a phishing or credential harvesting attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gingerbreadvillage.org/clients/e/e3/e396b250b60561adcb946853f9f62e29/File/20053411229.pdf
    • https://www.helpagesl.org/wp-content/plugins/formcraft/file-upload/server/content/files/160e05c5e7bc4f---xovoxine.pdf
    • https://anmimar.com/royal/userfiles/file/3845568983.pdf
    • http://1qjd.com/upload/files/2021-07-02-18-55-57-FhOa5e2n.pdf
    • http://www.jhannahs.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609185a287a2d---wepapowujoteferabelos.pdf
    • http://savitapiti.org/ckfinder/userfiles/files/wubab.pdf
    • https://mziagroup.com/wp-content/plugins/super-forms/uploads/php/files/nutrgm13c502aq28s92rg4kr3j/22556870764.pdf
    • http://matchonusa.com/uploads/files/lamowakal.pdf
    • http://intechsol.kz/wp-content/plugins/formcraft/file-upload/server/content/files/160995d1ac33ed---15174243023.pdf
    • http://jeugdopdewetenschapsagenda.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a306c1c2b1c---kuzidunafa.pdf
    • http://biurod9.pl/public/userfiles/file/78339308272.pdf
    • http://www.petersmetalstitching.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160aae86caf618---lupofanesukuregu.pdf
    • https://www.mercato.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1609e30ea950df---wedolokajetopimivaxurireg.pdf
    • http://galluccifaibano.it/userfiles/file/mivimoxap.pdf
    • http://www.zulfugar.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1606f71b48537a---lufixumowabegilobaruwog.pdf
    • https://bistro-8.com/wp-content/plugins/super-forms/uploads/php/files/3b94af6ea00dda7f8e731524c48624cd/24974702049.pdf
    • http://reclaimsplus.com/wp-content/plugins/super-forms/uploads/php/files/cb7949c329bbca4f0922da6942dc1330/kopupifaja.pdf
    • https://rffsev.ru/wp-content/plugins/super-forms/uploads/php/files/1af066af47228c1df249d2ec06902587/65688452060.pdf
    • https://www.simcoerecovery.net/wp-content/plugins/super-forms/uploads/php/files/0gulmu86cn9ol9g0oght1ahg90/gozifidobisalamevudefer.pdf
    • https://maturana.cl/upload/file/76804374902.pdf
    • https://smilepath.com.au/wp-content/plugins/super-forms/uploads/php/files/842ffb7113783b63a44ce3da22557273/1494529607.pdf
    • https://teplitsyoptom.ru/wp-content/plugins/super-forms/uploads/php/files/8c711636ed0c92cf19a0c9c6021224eb/kutevitowek.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/BkSY9tpko7c/uplcv?utm_term=specific+gravity+of+blood
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e6fb.bin
99dc856a80e8abddf0b669f28d01e4fcdbfc7e905e705de9d2ccbd21f2c94051		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE6FB 10920 bytes
font_01_sfnt_off00010006.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10006 16792 bytes
font_02_sfnt_off00011818.bin
6e8d72224537123f79f28fa837c5c0ddef50117ba4c9c3aaf556cf8b9b743bac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11818 16576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.