Malicious PDF — malware analysis report

Static analysis result for SHA-256 20bb6818bbeb377e…

MALICIOUS

PDF

75.7 KB Created: 2021-03-08 03:28:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8baa689752516e99d989350de176a123 SHA-1: e61edcc4053409e0727e7ae84030eedde56ca79c SHA-256: 20bb6818bbeb377eafbd475c5c2a223f24f045749fd295a29db3383993f958db
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to host or redirect to malicious content. The document body, though heavily obfuscated, suggests a lure related to search queries or information retrieval, consistent with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=words+for+confused
    • http://voirly.xyz/how_to_interpret_ratiow469j.pdf
    • http://tezijexipilimo.getenjoyment.net/brother_hl_5450dn_driver.pdf
    • http://sluzhba1.net/91480167679ei1jx.pdf
    • http://viniveba.mywebcommunity.org/graco_modes_jogger_se_stroller_reviews.pdf
    • http://kelimap.mywebcommunity.org/my_passport_ultra_driver_for_mac.pdf
    • https://magifoxokepo.weebly.com/uploads/1/3/6/0/136053300/3ade1e087c8f.pdf
    • http://groby-ritual.online/gebidigopitovurerofuuncoq.pdf
    • http://medicalpracticementor.com/ccnp_routing_and_switching_tshoot_300-135_official_cert_guide5tpsg.pdf
    • http://laulu-go.ru/how_to_become_a_certified_outboard_mechanic6gv3m.pdf
    • http://kasyanbeauty.com/cast_android_screen_to_pc2123f.pdf
    • http://adanakebap.org/chander_pahar_novel68teg.pdf
    • http://krepezh.guru/pugaxojusulozenamtve8e.pdf
    • https://sojabejob.weebly.com/uploads/1/3/4/8/134890412/getelefir_belos_mupew.pdf
    • https://rugovisatef.weebly.com/uploads/1/3/2/6/132682701/adba64f35923751.pdf
    • http://ing-jobs-opportunities.com/sylvia_plath_poems_analysisgdpu8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://21c505bb-01ca-4817-a549-4ed1ebba5040.filesusr.com/ugd/7d7105_811ded5b93494721a8a2bdbf07e2a38f.pdf?index=true
    • http://futikuzita.onlinewebshop.net/how_to_find_area_and_perimeter_of_irregular_shapes.pdf
    • https://d8acad56-eb9a-42d1-a06c-a695c5b02328.filesusr.com/ugd/0ad6c7_b8c221c78c3e4c8bab440a376296a086.pdf?index=true
    • http://kopolug.myartsonline.com/how_much_is_the_v_shred_app.pdf
    • http://tulifal.onlinewebshop.net/what_oil_do_i_need_for_my_husqvarna_lawn_mower.pdf
    • https://9e77dbea-16d6-438e-9859-4a68c5388828.filesusr.com/ugd/3225da_1de4591d17cc46fb8c7a093279d93d65.pdf?index=true
    • http://pavabiza.atwebpages.com/list_of_diagnostic_tests.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec35.bin
44c7919a3d2e494ecd50806135ae06298f92e2a296bd39147074889780bad0e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC35 4784 bytes
font_01_sfnt_off0000fc9f.bin
70fad4485451794bf9da496c55a5aa1a12ea02c3ff365fbafde8a8353a114ba4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC9F 10784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.