Malicious PDF — malware analysis report

Static analysis result for SHA-256 20e47bf9f4764849…

MALICIOUS

PDF

82.0 KB Created: 2021-03-18 03:50:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 86eeea4a8b11c5fa197a3fdbf3e5110b SHA-1: a5b1ddf756165fbd70d20e1e5c35e408b49ba212 SHA-256: 20e47bf9f4764849cbfe76c0be5d39587477adf0cb0d8649dd2e0406fdf77fdf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a lure related to product manuals.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=braun+series+7+790cc+4+manual+pdf PDF link annotation
    • https://cdn.sqhk.co/ragejeli/gjghRNQ/car_driving_games_free_download_for_windows_xp.pdfIn PDF document text
    • http://tihefers.online/when_a_mole_biopsy_comes_back_abnormal67tba.pdfIn PDF document text
    • http://kalidejomepajo.scienceontheweb.net/vefusur.pdfIn PDF document text
    • http://1xbet-regi.site/denon_avr-x4000_service_manuala09li.pdfIn PDF document text
    • http://junumidutuzakox.getenjoyment.net/musitekarazef.pdfIn PDF document text
    • http://lezirumari.sportsontheweb.net/acsm_health_related_physical_fitness_test.pdfIn PDF document text
    • http://nikepexi.22web.org/miocardiopatia_dilatada_2020.pdfIn PDF document text
    • http://fefikaniki.22web.org/nefawiteda.pdfIn PDF document text
    • http://bebosebe.66ghz.com/84239761320.pdfIn PDF document text
    • https://cdn.sqhk.co/butuxojusib/hjjjhhC/xuvowirezidagali.pdfIn PDF document text
    • http://compte-cmbretagne.best/venopabezem3x8lf.pdfIn PDF document text
    • http://djami.ru/vofuwetaxolupokujizivefa8u7u9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jimugivos/lagu_the_beatles_abbey_road_medley.pdfIn PDF document text
    • https://s3.amazonaws.com/kuxuxemu/ketuxifelologulukij.pdfIn PDF document text
    • http://lobamanomevid.rf.gd/relion_oximeter_reviews.pdfIn PDF document text
    • https://eee5dff6-7331-416e-acdf-593d0c386862.filesusr.com/ugd/21e9e0_657154d5c7024342a0b6accf54a7d0e3.pdf?index=trueIn PDF document text
    • http://ridabus.epizy.com/vevor_ice_cream_machine_manual.pdfIn PDF document text
    • https://badbb018-ab4e-499b-b788-960949b82e3d.filesusr.com/ugd/4f4c56_858c66c623374ed9a81568685ced50ee.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dutuzanob/91770920280.pdfIn PDF document text
    • https://s3.amazonaws.com/verirejon/bee_er_free_for_pc.pdfIn PDF document text
    • https://02796127-04ec-4c85-b270-c6f7310ebb18.filesusr.com/ugd/ce0e6d_0a930658eeb740b0b7c8d26336a9f6bd.pdf?index=trueIn PDF document text
    • https://746420f6-3007-491b-ba72-fd43be5094e5.filesusr.com/ugd/277b62_5190564762754eb38280af3439811460.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kisagoz/43926113891.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eaf4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAF4 5816 bytes
SHA-256: 477515e95531ff0270976fe69a84ab6d79822a5d4610b1ed024aebb22d2cdeaa
font_01_sfnt_off0000feb1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFEB1 11092 bytes
SHA-256: 2eeeedad5dcf05cea5b2c04d5bdd4736b113940e976b680adef57249bcc3a9dd
font_02_sfnt_off00012475.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12475 16348 bytes
SHA-256: 7ea4ad8fabf58a022be5f422cdf71e1d18c834a5727f5ba12988ec6015bab3a1

Open this report in the interactive analyzer, or submit your own file for analysis.