Malicious PDF — malware analysis report

Static analysis result for SHA-256 1fc8bfc1f2d10f33…

MALICIOUS

PDF

85.9 KB Created: 2021-03-18 14:04:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: afa64f7c7d19106464f60294920fcb92 SHA-1: e809b6cf15f18586ebec1ad03f0447a182a45248 SHA-256: 1fc8bfc1f2d10f33753fcf7d4ff4f880fd8a9d7076d7a75b62d09457db0be6ad
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into clicking it for information related to medical treatment. No scripts were extracted, but the PDF structure and embedded URI suggest a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=tratamiento+quirurgico+de+cancer+de+pancreas+pdf
    • http://finuxezanasa.mygamesonline.org/trastornos_alimenticios_libros.pdf
    • http://mkuu.club/52229016019mfrbl.pdf
    • http://marketes.pro/kayle_arurf_guide76co9.pdf
    • https://static.s123-cdn-static.com/uploads/4386607/normal_5fded5c505e81.pdf
    • http://cyberghost.store/rehab_gear_trent_sheltonn13ia.pdf
    • http://alexsaf.ru/67129973407zjchd.pdf
    • http://wunadimizurened.medianewsonline.com/wordly_wise_3000_book_8_lesson_11.pdf
    • https://static.s123-cdn-static.com/uploads/4458125/normal_6003af8576ab4.pdf
    • https://cdn-cms.f-static.net/uploads/4501385/normal_6045e4f874106.pdf
    • http://xabezoras.iblogger.org/high_tea_menu.pdf
    • https://static.s123-cdn-static.com/uploads/4454040/normal_60052f74d5fb4.pdf
    • http://lebepufu.mypressonline.com/miketilituzuzegedepos.pdf
    • http://labincom-med.ru/219620047530ktvo.pdf
    • https://cdn-cms.f-static.net/uploads/4489844/normal_6046b30d00cac.pdf
    • http://cashbackk.site/marche_en_bton_prfabriqu_leroy_merlins9vln.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://gonesipida.epizy.com/what_is_the_meaning_behind_the_song_dancing_on_my_own.pdf
    • http://ropupifalapoges.atwebpages.com/8855840469.pdf
    • http://gulagopafed.onlinewebshop.net/tolewomusedejetemamomisit.pdf
    • https://5be7aec3-7d66-433b-ae1d-2bfb807ddf2a.filesusr.com/ugd/24deb6_897f677aed38468eabb2fc04152a6a14.pdf?index=true
    • http://tixinova.rf.gd/teesri_adalat_movie_song.pdf
    • http://fiwemigusa.rf.gd/zufetegaviwavoxutokonav.pdf
    • https://d12e84a0-9808-45da-82c6-613dfe540d1b.filesusr.com/ugd/dc8a8e_a3f29f1aa975441db133b9d96e98f87a.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010111.bin
41facc7d5b5727ba70513f76950f43e13928483cd223ff4740c857f9748255b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10111 5400 bytes
font_01_sfnt_off00011349.bin
e821e64f48abfdfbe072011800b3f48225f2b8f62876e73bb77339b8943357fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11349 12692 bytes
font_02_sfnt_off00013b97.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13B97 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.