Malicious PDF — malware analysis report

Static analysis result for SHA-256 22cd9687360298cb…

MALICIOUS

PDF

84.4 KB Created: 2021-04-04 00:33:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 63fd30e4d15f6e056734344bd7bbe86f SHA-1: 182d1ed0126cd4961a48b2cb8e7c339205d933e8 SHA-256: 22cd9687360298cb63b866d63c834a09f4bd12ce605610658b01b09ed3081e03
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URL that mimics a search result for a medical condition, likely to trick the user into clicking it. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan PDF. No scripts were extracted, but the presence of external URIs suggests a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/aws?utm_term=what+causes+red+skin+on+lower+legs
    • https://static.s123-cdn-static.com/uploads/4413567/normal_60047e0f2e0d6.pdf
    • http://ersoil.fun/how_to_get_ps4_gold_headset_to_workrvk05.pdf
    • https://static.s123-cdn-static.com/uploads/4424933/normal_5ffe6d0c4caa3.pdf
    • https://cdn.sqhk.co/fupupusamun/OBWidqQ/mode_sans_smp_mcpedl.pdf
    • https://cdn-cms.f-static.net/uploads/4458412/normal_60137f82a87b3.pdf
    • https://cdn.sqhk.co/negolura/Aij95gh/sheltered_in_the_arms_of_god_ukulele_chords.pdf
    • https://cdn.sqhk.co/tokititagiwe/TFP62SM/91299308152.pdf
    • https://static.s123-cdn-static.com/uploads/4474736/normal_5ff4ad28b0451.pdf
    • http://xobalaxu.22web.org/98857012761.pdf
    • http://azakalaza3.xyz/156325890722tenr.pdf
    • https://cdn.sqhk.co/bisidilit/hhfgjaH/pac_man_fever_song_music_video.pdf
    • https://cdn.sqhk.co/wepenujofow/iihGHjj/38855126773.pdf
    • https://static.s123-cdn-static.com/uploads/4368732/normal_5febf2d9e8c43.pdf
    • https://static.s123-cdn-static.com/uploads/4403259/normal_5fefc805291d1.pdf
    • http://logoped-samara.ru/mezilemutorbr3w.pdf
    • https://cdn-cms.f-static.net/uploads/4408001/normal_6031f4f52e4f6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://d4f4546a-a836-4b3d-8651-c56b89608eca.filesusr.com/ugd/3e9e83_5a6622ed70e74de7a4bdd6799b00f9e0.pdf?index=true
    • http://riboparewi.rf.gd/dubosivivefosakadunutu.pdf
    • https://e6a48395-9ebc-465e-8505-c4b20d7b8e72.filesusr.com/ugd/81e12b_7f3481af416b4473aa42d9ed924780d8.pdf?index=true
    • https://c207dc97-0cc9-441e-8caf-a702c1639d46.filesusr.com/ugd/36abe8_b7eb20023cc64394a37e88c14ab1403d.pdf?index=true
    • http://xuvotawelotito.epizy.com/tri_fold_brochure_template_adobe_illustrator_free.pdf
    • http://gozipoxux.rf.gd/what_is_spanning_tree_protocol_and_why_is_it_used.pdf
    • http://zopegekole.rf.gd/momuriwidedalonipolonit.pdf
    • https://5f8b0e40-2141-4341-98ab-6145db4b8156.filesusr.com/ugd/2072cd_ac2ae5084f1348dfadeece3f33a929ef.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f999.bin
d01df1918f7a0dd84582828c30c375aa8dabfcbf7ce9138025851e0de173537f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF999 5252 bytes
font_01_sfnt_off00010b7c.bin
61feae0745a5b868adb290ebcac35eff411dc2ad8913f619f36a7fc4c44327c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B7C 12536 bytes
font_02_sfnt_off0001346d.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1346D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.