Malicious PDF — malware analysis report

Static analysis result for SHA-256 2026f09fd5029777…

MALICIOUS

PDF

70.8 KB Created: 2021-03-17 16:47:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ab6c6442e6ffd8c53e8fb6524b874aa8 SHA-1: 611fe4af856d4a277225588535dc2c671001d48b SHA-256: 2026f09fd5029777ac30f1a569f235723e7e7b382f26b20ef1f230b731db3850
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that redirects to a malicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, appears to be a lure related to a 'George Foreman grill manual', suggesting a phishing attempt to trick users into clicking the embedded link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=george+foreman+grill+manual+gr20
    • https://gifivetusox.weebly.com/uploads/1/3/4/7/134736849/1fc667faac3128.pdf
    • https://tatogupuragafa.weebly.com/uploads/1/3/4/0/134096405/kefekagazetonez-morasokebe-garilukogo.pdf
    • http://vsspb.ru/nadigerofagixolamogutn3evp.pdf
    • https://namobilezivi.weebly.com/uploads/1/3/1/8/131857476/didavukepagajogo.pdf
    • https://cdn.sqhk.co/zidexamuwela/em4hdhh/faith_family_church_fayette_mo.pdf
    • https://static.s123-cdn-static.com/uploads/4408330/normal_5fe56a737b77f.pdf
    • https://cdn.sqhk.co/gewanunu/khdicib/41057072637.pdf
    • http://souve.me/tuperudofurakst6iu.pdf
    • https://cdn.sqhk.co/guledijuxi/5rWSgiL/tech_deck_skateboarding_game_play.pdf
    • http://leoidet.xyz/jvc_kd_r740bt_change_colorkroow.pdf
    • https://pirovosarelivo.weebly.com/uploads/1/3/1/4/131406751/6039619.pdf
    • https://cdn.sqhk.co/bosesegivu/EzgiR9B/ravensburger_3d_puzzle_night_edition_statue_of_liberty.pdf
    • https://cdn-cms.f-static.net/uploads/4444366/normal_6048fbb7572c2.pdf
    • https://cdn-cms.f-static.net/uploads/4416316/normal_603aa606c9d34.pdf
    • https://static.s123-cdn-static.com/uploads/4387709/normal_5fe5647a3e419.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/310a812f-669c-4656-8746-67493dbd1023/xilowerewobawafu.pdf
    • https://s3.amazonaws.com/kovozenamofox/pesomaboveradaj.pdf
    • https://uploads.strikinglycdn.com/files/9748559d-2825-40c1-abd6-8a1ae7591cc3/drawing_for_dummies_book.pdf
    • https://uploads.strikinglycdn.com/files/083d241f-3441-4f79-96b5-ec0ccc923cd9/the_other_side_of_heaven_2_fire_of_faith_streaming.pdf
    • https://s3.amazonaws.com/loranoduzuja/ocean_of_is_back.pdf
    • https://uploads.strikinglycdn.com/files/0cdc43a4-23f3-4fa6-a09d-03f591e306fa/nikon_coolpix_s6000_price_in_bangladesh.pdf
    • https://s3.amazonaws.com/juwofuxufijup/science_8_density_calculations_worksheet_key.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d85b.bin
f271a945b0a62558824c3a1448822c045e9199dbbdae0cb8211e762ea96969b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD85B 5216 bytes
font_01_sfnt_off0000ea0a.bin
c5a4585446fc06d93c9fbdf7bce19937770a2decf13786782fe0ec6f820995eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA0A 10488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.