Malicious PDF — malware analysis report

Static analysis result for SHA-256 1dd6ba38af4b1fb3…

MALICIOUS

PDF

68.1 KB Created: 2021-05-17 11:46:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 015d41578f40d2c22bdb441c8b2f0bb0 SHA-1: e42e0dc887770b39a4615f2c972749275fa6a135 SHA-256: 1dd6ba38af4b1fb3275041305abc7dad6454ef5b343eee87b91ce831c0f54ba6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of numerous embedded URLs, many pointing to PDF files hosted on various domains, suggests a phishing or malware distribution campaign. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of an attempt to trick users into downloading further malicious content, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/160757be6a20b5---fifibaxapatone.pdf
    • http://aweibel.com/Photo/file/repenakutoravovugifeginot.pdf
    • https://swimproject.eu/wp-content/plugins/super-forms/uploads/php/files/7997d5b985d12495abaa0a48913b3ee5/77550054085.pdf
    • http://www.festivalmarrakech.info/wp-content/plugins/formcraft/file-upload/server/content/files/1609f6922ed3d5---lovuzoxijubugozijino.pdf
    • http://historia-bfured.hu/userfiles/file/78481361741.pdf
    • http://www.loicadesacavem.pt/wp-content/plugins/formcraft/file-upload/server/content/files/16083e40ce288a---23348990304.pdf
    • https://desertflying.club/wp-content/plugins/formcraft/file-upload/server/content/files/1607b5c8931ac8---24284051645.pdf
    • http://www.siscard.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090efc4379c7---56902785162.pdf
    • https://andrejc.si/files/file/penosuzejasewil.pdf
    • http://www.finanzanlagen-honorarberatung.de/wp-content/plugins/formcraft/file-upload/server/content/files/16086d465ca9fc---31024483878.pdf
    • http://graphicon.hu/wp-content/plugins/formcraft/file-upload/server/content/files/1608694fc3476f---70574682923.pdf
    • https://lorenzonimmigrationlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160902a5131f7c---32400568335.pdf
    • http://www.barankayalar.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16093b236b57b1---60461799975.pdf
    • https://singaporeroadshow.com/wp-content/plugins/super-forms/uploads/php/files/a6a5efecd79af411b0c96e280fdb4dc7/vabak.pdf
    • https://joepromenshealth.com/wp-content/plugins/super-forms/uploads/php/files/7907abb59eb477e3e145e9f78f19827f/digumuwetab.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/DOqCt-cVA4I/uplcv?utm_term=bescherelle+pdf+gratuit
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cc1a.bin
c8124f4ff7bcdbe6ae2ee982ed5c8d7c6f097cc92b30bd51be0340a026794a96		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCC1A 5468 bytes
font_01_sfnt_off0000deb2.bin
c16cf15a03a17484246d94808ada0c8b8b47d3f884ef2b7c686751fa99347713		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDEB2 10716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.