Malicious PDF — malware analysis report

Static analysis result for SHA-256 23be07ad932dbac2…

MALICIOUS

PDF

84.9 KB Created: 2021-03-14 11:13:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: fa858a4df0f9768a50b29b43c66c8041 SHA-1: 8bce4ab1183dbd860d4d6ad8db998dc095eca0e4 SHA-256: 23be07ad932dbac2daf31b69771f5d3ac0b04ba77101af742a905cb3d9160e30
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, which points to a suspicious domain. The ML classifier and ClamAV detection strongly suggest malicious intent, likely a phishing attempt to redirect users to the identified URL. No scripts were extracted, but the presence of the malicious URL is the primary indicator of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=32+accounting+standards+list+pdf PDF link annotation
    • https://cdn.sqhk.co/mavozopofug/ibUibjf/85239527652.pdfIn PDF document text
    • https://cdn.sqhk.co/vizelupavew/iagfMjh/nail_designs_short_nails_ideas.pdfIn PDF document text
    • https://mupoveno.weebly.com/uploads/1/3/4/3/134371030/30b0dd1efc.pdfIn PDF document text
    • http://ing-jobs-opportunities.com/2068791498336zsm.pdfIn PDF document text
    • http://merotudonor.mypressonline.com/yongnuo_yn-560_iii_setup.pdfIn PDF document text
    • http://nigodofifulo.scienceontheweb.net/rheem_hot_water_tank_sizes.pdfIn PDF document text
    • http://bluetea.space/ticket_to_ride_board_game_reviewcz43x.pdfIn PDF document text
    • http://copyright-rules-help.com/craigslist_denver_for_sale_by_owner_boats2e5um.pdfIn PDF document text
    • https://ditezuni.weebly.com/uploads/1/3/5/3/135350757/xuxiwip.pdfIn PDF document text
    • https://wuxinaruniluxod.weebly.com/uploads/1/3/4/8/134882591/1488857.pdfIn PDF document text
    • https://cdn.sqhk.co/tolononof/fO7ijjf/21324956260.pdfIn PDF document text
    • https://cdn.sqhk.co/sipebililofo/hcKginP/drive_in_movie_near_me_nj.pdfIn PDF document text
    • https://kuzosilu.weebly.com/uploads/1/3/2/8/132815793/mepofupaku.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/c4ce0a38-9c26-4677-bcba-1253cf0f4add/jiluzol.pdfIn PDF document text
    • https://s3.amazonaws.com/susonanezaj/5019188592.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4578a54d-5762-45ef-b22f-1294f1658cc5/how_to_reset_samsung_dryer_vent_sensor.pdfIn PDF document text
    • https://s3.amazonaws.com/luropi/lymphoma_contouring_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/jepinebawo/worksheet_for_cardinal_ordinal_numbers.pdfIn PDF document text
    • https://s3.amazonaws.com/potamotaz/devukodulelafumadozajux.pdfIn PDF document text
    • http://tixofimisupabev.onlinewebshop.net/asterix_e_cleopatra_portugues.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE18 5288 bytes
SHA-256: e61d6374fceab9faa0a250370e3c3638849c04bcd1672b528bcb5aa7b0f87a0f
font_01_sfnt_off00011004.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11004 11784 bytes
SHA-256: 6baf1f53c0835f6768ef8391b0dbd31e2ad58687e9781e7b973a371d5072a925
font_02_sfnt_off00013850.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13850 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.