Malicious PDF — malware analysis report

Static analysis result for SHA-256 2567f99f10d9b7bd…

MALICIOUS

PDF

85.1 KB Created: 2021-06-03 07:25:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02856f005975ee97d5603d56539db4be SHA-1: dc955929126030af4bb390bb5cc1ce9bd2150bab SHA-256: 2567f99f10d9b7bd7a8295a637812f0fe32fa576418ba6be0bb65fc7f0a734a8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The document body, though heavily obfuscated, appears to be related to streaming services, reinforcing the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ketchas.ru/pbw?utm_term=la+la+land+streaming+australia
    • https://static.s123-cdn-static.com/uploads/4465123/normal_5fcab012a45e3.pdf
    • https://cdn-cms.f-static.net/uploads/4493891/normal_604ce7378c7cc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/3982567e-247d-4748-be18-d6b6db395585/walking_in_the_moonlight_malayalam_mp3_download.pdf
    • https://uploads.strikinglycdn.com/files/dc814146-5fd1-49d4-94b6-d4d5c098f71f/96341687418.pdf
    • https://uploads.strikinglycdn.com/files/341c6201-bebd-4409-8d06-64595236e20e/52475101722.pdf
    • https://uploads.strikinglycdn.com/files/bad5db2c-b202-4847-9a49-b3a9825c4dfe/tawagowoziziwab.pdf
    • https://uploads.strikinglycdn.com/files/44d83735-53d8-4084-923c-7c73184f98e8/11520778273.pdf
    • https://uploads.strikinglycdn.com/files/60e73782-d41d-4f61-9b90-e0caea00dff6/suguzodubaruvupajidata.pdf
    • http://redejok.pbworks.com/f/why_is_my_flash_drive_blinking_red.pdf
    • https://uploads.strikinglycdn.com/files/990144df-888d-41cb-8917-1c6323e110c2/19192399579.pdf
    • https://uploads.strikinglycdn.com/files/d76cb991-627e-4cf8-b80b-87b7538cf713/are_the_inner_planets_in_order_from_smallest_to_largest.pdf
    • http://nosegawibaso.pbworks.com/f/birumoz.pdf
    • http://redejok.pbworks.com/w/file/fetch/144520443/diferencia_entre_fonetica_y_fonologia_en_ingles.pdf
    • https://uploads.strikinglycdn.com/files/b59c0893-fb62-45ef-ab0a-fc4e27d67517/ishmael_daniel_quinn_takers_and_leavers.pdf
    • http://misabovu.pbworks.com/f/67451332956.pdf
    • https://uploads.strikinglycdn.com/files/4125fa5b-6845-451f-b378-5a70e864dd9f/2004_jeep_grand_cherokee_patch_panels.pdf
    • http://tujelupirobe.pbworks.com/w/file/fetch/144494232/92903316884.pdf
    • https://uploads.strikinglycdn.com/files/96d0e71c-64f1-4499-9e9b-b056039f6988/41807961172.pdf
    • http://wuranosa.pbworks.com/w/file/fetch/144414786/cre_notes_form_4.pdf
    • https://uploads.strikinglycdn.com/files/cb7a17a5-8bec-4105-9fe3-1f8b549ac74f/is_a_new_harry_potter_book_coming_out.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000104ab.bin
34e27a2abba76ed3fe12aeb3091b6f001f8c9ec6373a78d1f129575249f407da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104AB 4856 bytes
font_01_sfnt_off0001150b.bin
4d8ffa808efcf2f63615280e8ef7fa8d59099b555014596405786c048f525cfb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1150B 10572 bytes
font_02_sfnt_off00013908.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13908 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.