Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d7ffb26c324a2c5…

MALICIOUS

PDF

93.7 KB Created: 2021-03-20 16:41:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 669b0a3768c2f94d092a04f6eb562bd9 SHA-1: a7bbc337a2c50afbdeebcb4359dd5ed09f2dc7bf SHA-256: 1d7ffb26c324a2c582667bf34e9e1dda8ab1a5e0db8a4327ca1544b7461ac66c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. It contains an embedded URL pointing to a suspicious domain, likely intended to host a malicious payload or redirect to a phishing site. The document body, though heavily obfuscated, appears to reference a 'Fender super twin reverb owner's manual', suggesting a lure to trick users into downloading or interacting with the malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=fender+super+twin+reverb+owner%2527s+manual PDF link annotation
    • http://xupulakikovuxo.mypressonline.com/2011_rav4_limited_for_sale.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4425772/normal_5fe3a5943353b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425506/normal_5fdb536414e50.pdfIn PDF document text
    • http://kasyanbeauty.com/minn_kota_talon_151zii5.pdfIn PDF document text
    • http://avit0.cc/1631129185347sas.pdfIn PDF document text
    • http://odemebayisitrafik.com/bovunewemewazekt778m.pdfIn PDF document text
    • http://afracheat2.xyz/how_big_is_30mmekho0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485163/normal_6015fc3241316.pdfIn PDF document text
    • http://trycabinets.xyz/finding_bliss_2009_full_movieqg3jo.pdfIn PDF document text
    • http://bomaduworofa.medianewsonline.com/56523367049.pdfIn PDF document text
    • http://gejedesoni.getenjoyment.net/10528152687.pdfIn PDF document text
    • http://omerkatanalp.com/11474896507e6rms.pdfIn PDF document text
    • http://volosaty100.xyz/what_if_song_kane_brown_lyricshspb0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4378152/normal_5fc8556579bf9.pdfIn PDF document text
    • http://mavitrade.com/jogazimaburovm2024.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/rirusozo/talk_to_me_in_korean_level_5_lesson_10.pdfIn PDF document text
    • https://s3.amazonaws.com/vonuxagupeduze/gambar_wallpaper_kartun_lucu.pdfIn PDF document text
    • http://dozopedatofol.atwebpages.com/vewaralobijevegijafog.pdfIn PDF document text
    • https://s3.amazonaws.com/widetunipet/new_south_movie_action.pdfIn PDF document text
    • https://s3.amazonaws.com/gezejoputiwinu/pilocytic_astrocytoma_rosette-_forming_glioneuronal_tumor.pdfIn PDF document text
    • https://s3.amazonaws.com/vavapekadoliti/what_is_a_daphnia_heart_rate.pdfIn PDF document text
    • https://s3.amazonaws.com/semuxemakaw/61904952762.pdfIn PDF document text
    • http://sakogabutal.onlinewebshop.net/dipawata.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000105ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105EC 3076 bytes
SHA-256: 9433401bc3f6db49df4ac9e46b96d8d0a079012b1cc0ce071dde4731ecac8768
font_01_sfnt_off000110e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x110E5 5384 bytes
SHA-256: fc9061fdf5e4b21e3b95c78077da44e5e76ac2b8815fd6947a5cc4172a14cde0
font_02_sfnt_off00012332.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12332 13716 bytes
SHA-256: 4f3ee68d13cbd82d45b612c244801cf2280feff38e058f065eb53b3d468245a3
font_03_sfnt_off00015153.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15153 16284 bytes
SHA-256: 2ec79c9529011e94489ae2225858381fd35f16877182f1cb6cbef0642111bced

Open this report in the interactive analyzer, or submit your own file for analysis.