Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f1d159900ca3d7d…

MALICIOUS

PDF

92.1 KB Created: 2021-06-28 02:23:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 87ba42bb65a1eca8a2fb55e54278e3c0 SHA-1: 3253935d09311251a1515592d81cc9cd0381373d SHA-256: 1f1d159900ca3d7d520e478b2f4a2d3a2c3f57169c42a954c1325d70bab0b81f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. Although no scripts were explicitly extracted, the presence of embedded URIs and the overall detection suggest an attempt to exploit users through a malicious document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/uplcv?utm_term=well+mannered+man+meaning
    • http://accessiblevehicleservices.com/userfiles/file/fotobitanatoduxev.pdf
    • http://alexlunacoach.com/img/editor/file/wefepogutorenu.pdf
    • https://graffitipaintstudio.com/wp-content/plugins/super-forms/uploads/php/files/6b887f8cd0ad8d275cfa86db954e100f/fazijemazaned.pdf
    • http://akkoryazilim.com/userfiles/file/47477908163.pdf
    • http://e-kva.ru/admin/ckfinder/userfiles/files/fogebaxojaninexapebive.pdf
    • http://clinicaveterinariaalbese.eu/userfiles/files/sixebibuz.pdf
    • https://dentinale.eu/wp-content/plugins/super-forms/uploads/php/files/710d97b920bcaac55ac43360f18915e5/39523246411.pdf
    • https://www.alongsideasia.com/wp-content/plugins/super-forms/uploads/php/files/bd06a5a17ccab94a4e394c3388472ae3/66019743868.pdf
    • https://motelandratecuci.ro/userfiles/file/48515432302.pdf
    • http://smithmurdock.com/wp-content/plugins/formcraft/file-upload/server/content/files/160778ed7aa308---16592126062.pdf
    • https://bikinibody.be/wp-content/plugins/super-forms/uploads/php/files/j5p5s3k69fmafc86sk2cc80uoc/32443932045.pdf
    • http://southportrubbish.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b78964a7cc4---88791425712.pdf
    • https://backcountryplayground.com/wp-content/plugins/super-forms/uploads/php/files/e68081f868df6ba1b7522b5163f374a9/gifutekasejexifupojam.pdf
    • http://vdadanang.vn/app/webroot/assets/files/34072643310.pdf
    • http://highlandhighclassof1962.com/clients/c/c3/c330a44b04b080977bf299ea430a317d/File/5120244120.pdf
    • http://arcomproltd.com/userfiles/file/rojovixupoza.pdf
    • https://parquesanalbertohurtado.cl/ckfinder/userfiles/files/26524720463.pdf
    • https://apparel.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/0aa36543aa8b759baf2acf199f935554/baxesuxisogifat.pdf
    • http://tatnhapkhau.com/ckfinder/userfiles/files/lunegarekoperolovew.pdf
    • http://nc2e.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160d8eb5fd30e7---99085687550.pdf
    • http://distributoram.com/files/file/panusugoziwodusokubop.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8c0.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8C0 16792 bytes
font_01_sfnt_off000100d2.bin
71631d2b317af4e7087720db760e5e7c5fa5aba3f365435398c38f67fcac0e2a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100D2 21832 bytes
font_02_sfnt_off00013760.bin
08b595082f305a63ae294108f0a0622809d0cc4d82feaac90cf12a171fb0ae77		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13760 16064 bytes
font_03_sfnt_off00014c7c.bin
1facd21470f6da7205d10b440baa163aa28e5884bbbb825a08c49356a1a8680d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14C7C 10200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.