Malicious PDF — malware analysis report

Static analysis result for SHA-256 239a54af2fb58ffa…

MALICIOUS

PDF

232.4 KB Created: 2021-03-22 07:13:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 02b0638186b0e0464f9acd397e708525 SHA-1: b8926c4caf5ef3ae558458a4088617705c4165d7 SHA-256: 239a54af2fb58ffa1e7dd8a03968a180fdb19f0f7571102903253cfd262d3eaf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URI that points to a suspicious domain, likely intended for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest it's designed to trick users into visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9958

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=poemas+de+andres+bello+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4407789/normal_5fe803bf78ac7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370541/normal_60186589c970d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449012/normal_604f5b0818030.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478393/normal_605589e546434.pdfIn PDF document text
    • https://kajagopop.weebly.com/uploads/1/3/4/7/134729443/d3db896.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446770/normal_5fdd69f179ed7.pdfIn PDF document text
    • https://tapizijivuvol.weebly.com/uploads/1/3/2/6/132696465/1408377.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/26eea25f-6428-411c-8390-b2e8a0e05fac/tafafoxawenevatumo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9babd2a3-b0ed-40a3-919f-f7cb0fe07322/wiring_diagram_for_18_hp_briggs_stratton_engine.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20c089b9-5018-4934-a709-7b9a74c838ed/35555745853.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/faee1828-3bd4-4e43-81bb-831192abb88c/dungeons_and_dragons_cartoon_character_stats.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0df80666-e88c-4966-b008-a429a815348c/is_royal_edition_worth_it.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/78d65997-902e-4b82-a785-5487628d64af/trane_cleaneffects_installation_manual.pdfIn PDF document text
    • https://b5d51143-f34a-4a4f-9265-6917490cb775.filesusr.com/ugd/9f69bd_2eb270cb667146afaacb156f04f5a398.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/35b048c0-a904-480e-9168-2406a9099163/plumbers_union_hall_near_me.pdfIn PDF document text
    • https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_0e4a230e4cc540789d97edf5f45516f9.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c69074d9-f467-4c2d-bf10-5fdebdf0f5a6/gugibozi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d99f3f4a-ae5d-4470-92b7-0010096b48cd/how_do_you_connect_beats_solo_2_wireless.pdfIn PDF document text
    • https://f78a7b13-e75c-4ddc-9f3c-03cd83736f6c.filesusr.com/ugd/90c53f_511dc9858c9547dc8d6f15f55b80a618.pdf?index=trueIn PDF document text
    • https://19e6fc83-c281-4d06-93fd-e8b16a02b90a.filesusr.com/ugd/ce5d00_8bb690b6b8c1494cb12ddd0786e57aae.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9380e55-4dae-450b-9710-96672b8c404e/four_theories_of_motivation_psychology.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00035721.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x35721 5328 bytes
SHA-256: 2d38254354d4c0711272423c57e1d29e71ba2d32e30e194943837767c8aabe7a
font_01_sfnt_off0003691b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3691B 12604 bytes
SHA-256: 90549a58cde432caf9accc524f96e680467c3d2aa2d3856269cf066224fc97ae

Open this report in the interactive analyzer, or submit your own file for analysis.