Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c83f432ac133ab0…

MALICIOUS

PDF

90.2 KB Created: 2021-01-13 05:12:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: b0e7b59f09f3e541cbb127653d4c812e SHA-1: 1e8b5d51dc6ac38ab5758a81884b72fee3ae0aeb SHA-256: 1c83f432ac133ab04019dd96b5012c9096deed3a3effcc08529aee3eda431844
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. ClamAV and ML classifiers flagged this PDF as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, contains text related to asset retirement, suggesting a lure to disguise the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/123?utm_term=for+what+reasons+are+plant+assets+retired PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4454965/normal_5fe7a2c1a5784.pdfIn PDF document text
    • https://cdn.sqhk.co/sugifila/jisEihH/77820461544.pdfIn PDF document text
    • https://ridolagu.weebly.com/uploads/1/3/0/7/130775195/6716312.pdfIn PDF document text
    • https://cdn.sqhk.co/sofetarunox/g1geqrO/neon_orange_nike_running_shoes.pdfIn PDF document text
    • https://site-1195445.mozfiles.com/files/1195445/reading_comprehension_worksheets_for_third_graders.pdfIn PDF document text
    • https://site-1171394.mozfiles.com/files/1171394/fibromyalgia_treatment_guidelines_american_college_of_rheumatology.pdfIn PDF document text
    • https://cdn.sqhk.co/nubalevuvem/a2hijf3/edward_snowden_wife_lindsay.pdfIn PDF document text
    • https://muwefojiginilu.weebly.com/uploads/1/3/4/5/134512592/sikogumeroxinizo.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4388283/normal_5ff89367db693.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377938/normal_5fcaea2241e8d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366305/normal_5f8bc76d2ceec.pdfIn PDF document text
    • https://cdn.sqhk.co/gimexigerub/jHMDdji/swing_manager_mcdonald_obowiazki.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vetamedisoz/australia_melbourne_city_video.pdfIn PDF document text
    • https://s3.amazonaws.com/xoferuzu/emu8086_free_for_android.pdfIn PDF document text
    • https://s3.amazonaws.com/poresi/jazavoxunovu.pdfIn PDF document text
    • https://s3.amazonaws.com/jivagajamav/25961658579.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000125d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125D6 5096 bytes
SHA-256: 9f770b10764170a5ba674fd48a5d23fc14ac957b2bc24622dd5db46bf08e5fa0
font_01_sfnt_off00013736.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13736 10568 bytes
SHA-256: 54c08b13ae34bd4a1f3b9af68b57db0148ded4346818de213a458d0424c6ad9e

Open this report in the interactive analyzer, or submit your own file for analysis.